Products > Test Equipment

Hantek - Tekway - DSO hack - get 200MHz bw for free

(1/640) > >>

The topic is about how to hack another one Chinese DSO (Tekway/Hantek) up to 200MHz bandwidth.

-short history

When my Tek TDS754D died some time ago i had to find a replacement. At that time (2009) I ordered few
cheap known china DSOs and tested them in detail:
- UNI-T (UT2102CE)
- Rigol (DS1102E)
- Atten (ADS1102CE)
- Tekway (DST1102B)

Finally i decided to take Tekway DST1102B instead of Rigol DS1102E because :
(ATTEN and UNI-T was at that time simply useless crap)

- 7" high quality display (Innolux AT070TN83 V1) with 800 x 480 resolution
- display viewing angle designed for "on a shelf above the workbench" use
- DPO-like functionality
- 2500 wfrms/s update rate
- Linux OS on good known Samsung ARM S3C2440 SoC
- modern firmware with lot of unique (in the <1k USD DSO price class) features

Tekway call these model "Tekway DSO 2.0 Platform", and yes, there was "DSO 1.0 Platform" in 2008-2009
but that completely different gear (with 2.5k memory depth, 320x240 display resolution and TEK TDS2000 like firmware)

In the meantime there are as well Hantek DSOs/Handhelds using that Tekway DSO 2.0 platform, as well some rebadged
models (some made by Tekway, other by Hantek) from Extech, PCE, Voltcraft, Protek, ICEL, AKIP, Redsea, Zhongce, etc !!!

-what inside Tekway/Hantek

i have reverse-engineered the hardware and made schematics:

 -hw0 (produced from Dec 2009 to Feb 2011)    ready
 -hw1005 (produced from Feb 2011 to Jun 2011)    ready errata in work
 -hw1007 (produced Jun 2011 to xxx 2013 , DSOs and MSOs with S/N < 15000)    ready

 -handheld hw1001 (S/N < 15000)    in work
 -DSO5xxxP hw1.0    on to do list I've made alrady schematics of the new input circuit:

- before you hack made a backup - if you wish
It make sense to make backup of whole NAND flash (firmware+setting) before any hack attempt.
I have prepared easy to use "firmware update" files, simply choose your model, download the tool
and read the included Readme.txt to proceed.

For all following "B" model benchtop DSO with S/N < 15000
 - Tekway DST1062B, DST1102B, DST1202B
 - Hantek DSO5062B, DSO5102B, DSO5202B
 - Voltcraft DSO-3062C, DSO-1062D
 - Zhongce DF1202CL, DF1102CL, DF1062CL
 - Protek 3006, 3010, 3110, 3120

For all following "BM/BMV" models benchtop DSO with S/N < 15000
 - Hantek DSO5062BM, DSO5102BM, DSO5202BM
 - Hantek DSO5062BMV, DSO5102BMV, DSO5202BMV

For all following "B" and "D" models benchtop MSO with S/N < 15000
 - Tekway MST1062B, MST1102B, MST1202B
 - Hantek MSO5062D, MSO5102D, MSO5202D
 - Voltcraft MSO5062B, MSO5102B

For all following "B", "BV" and "S" models handheld DSO with S/N < 15000
 - Hantek DSO1062B, DSO1102B, DSO1202B
 - Hantek DSO1062BV, DSO1102BV, DSO1202BV
 - Hantek DSO1062S, DSO1122S, DSO1152S
 - Extech MS6060, MS6100, MS6200

For all following "P" models benchtop DSO with ANY S/N
 - Hantek DSO5072P, DSO5102P, DSO5202P
 - Falcon DSO100C1G (this one )

For the cute old Tekway DST1000/DST3000/DST4000 please PM me.

For all others (not listed above) DSO/MSO/Handhelds  (e.g. with S/N > 15000) please use integrated command line tool "nanddump", do a search in thread to check how that might work.

When you need to restore previously created backup, check the Readme.txt from backup tools above and/or following links:

- the bandwidth hack

As far i know, all DSO/MSO/Handhelds since 2009 (so yes, even the latest "P" models) can be hacked.
To hack the bandwidth all you need to do is to rename one file in DSO root directory
- when you have 60MHz/70MHz model (no matter if benchtop or handheld) you must rename /dst1062b to /dst1202b
- when you have 100MHz model (no matter if benchtop or handheld) you must rename /dst1102b to /dst1202b
- when you have 150MHz model (no matter if benchtop or handheld) you must rename /dst1152b to /dst1202b

then after second reboot (yes, you have to reboot twice) the new bandwidth (and when you decided to go
up to 200MHz bandwidth the 2ns/DIV timbase as well) will be available.

To do this you can use that tool (then simply choose what bandwidth you wish and click on "Change bandwidth")

or that tool (then go to "Shell F2" tab and execute there for example  "mv /dst1062b /dst1202b")

or you can connect via UART to DSOs Linux shell and work from there. You will of course need to open the enclosure
and connect to PC via UART to USB converter (e.g. ebay CP2102 UART to USB etc). For the UART pinout check pictures below.

- optional - the bootlogo hack

you might wish to change the boot screen logo as well (not necessary for bandwidth hack).

For all following "B" model benchtop DSO with S/N < 15000
- Tekway DST1062B, DST1102B, DST1202B
- Hantek DSO5062B, DSO5102B, DSO5202B
- Voltcraft DSO1062D, DSO3062C
- Zhongce DF1202CL, DF1102CL, DF1062CL (i don't have logos from Zhongce)

Download, when missing, all the boot logos
and copy to yor DSOs /logo directory

You will have as well to edit /logotype and /logotype.dis files. The best is to use "vi" editor on the DSO shell,
you might as well copy these two file to PC and edit there. All you need is to change the DSO name from
what it is to what you wish to see, e.g. for Hantek DSO5062B you need to change in /logotype the dst1062b to dst1202b
and in /logotype.dis the hantek_DSO5062B to hantek_DSO5202B.

If you have questions - use search, or ask in this thread.

For all other following benchtop and handheld models with S/N < 15000
- Hantek Handheld DSO1062B/BV, DSO1102B/BV, DSO1202B/BV
- Hantek Handheld DSO1062S, DSO1102S, DSO1152S
- Tekway MSO MST1062B, MST1102B, MST1202B
- Hantek MSO MSO5062D, MSO5102D, MSO5202D
- Voltcraft MSO MSO5062D, MSO5102D, MSO5202D
- Hantek DSO DSO5062BV/BMV, DSO5102BV/BMV, DSO5202BV/BMV
- Extech MS6060, MS6100, MS6200

you have to edit a specific execuatable (as the logo is compiled into it), all necessary tools are here:

For all other following benchtop and handheld models with S/N > 15000 (exept "P" models, they can have ANY S/N)
- Hantek DSO5072P, DSO5102P, DSO5202P
- Hantek MSO5074F, MSO5074FG
- Tekway/Hantek MSO7000B series
- Tekway/Hantek DSO/Handheld/MSO with S/N > 15000 and hw1.0 or hw1.10 (so all with S3C2416 SoC)

All i can tell for now is that the boot logo seems to be compiled into display driver

-optional - frontend hack (models with SN < 15000)

It seem that since some time Hantek/Tekway/Voltcraft is using not that great combination of resistors in frontend, it was nearly perfect originaly but they changed it to what is today. Saving everywhere (or for reason to gie all hackers bad respons?) ^^
No matter, we can fix it easily, for more information and lot of measurment results see

-optional - EEPROM licensing hack
sometimes one need or wish to enable some extra things, like LAN, more memory, video, etc. The licensing for these functions is stored in EEPROM, see here how to make use of them:

-bug list

see attached - note, this list is not up to date, i have to work on it :\[/s]

-SDK, LabView, other hardware hacks, tons of other things

simply check the post below

-Hantek's OneDrive

-and finally my OneDrive with hacks, firmwares, tools, etc:

my 1drive share .. PM me if does not work for you

If you like what there and wish to support me/my hacks, then feel free to donate,
there is PayPal "donate button" when you click on my "home website" icon @ my eevblog forum profile.


If you wish to connect to the UART, check attached pictures

all other hacks temp removed ... in last 4yrs there was so much said, hacked and released that one can easily get lost. Wht i'm doing now is to sort all that knownledge, and split into models/hw version sections. All that information will be the posten here and of course on my OneDrive (see above post for link).

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

Thanks - that's really interesting.

As far as I know, both the GW-Instek and Rigol scopes deal with all of the display logic in the FPGA, so have quite limited ability. The UI on these scopes looks a lot more fancy.

Awesome job, tinman and welcome the eevblog, what a great way to start.

Don't know much about tekway, but now its worth looking in to.


[0] Message Index

[#] Next page

There was an error while thanking
Go to full version