Author Topic: Hantek - Tekway - DSO hack - get 200MHz bw for free  (Read 1645129 times)

0 Members and 4 Guests are viewing this topic.

Offline amigo

  • Regular Contributor
  • *
  • Posts: 108
  • Professional Wannabe
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #600 on: May 28, 2011, 12:26:55 am »
yeah, i created some shortcuts in my first posting to save some reading time )
I saw those, but you made many more posts in-between that I found having valuable information. I actually pasted it all into a text file so I can refer to it later and contemplate what's said. :)

Quote
how come ?
I was building a new workbench and my equipment was all stacked aside waiting for the build to finish. It just took sooooo long but here's the product of that labour:


Quote
hacked device is working exact as original device, so as you hacked you can use manufacturer firmware updates
(for the target model, which i assume is now 200MHz model).
Manuall copy work of course too, but it's not that handy is you don't have LAN addon board or at least uart port outside DSO.
Appears it worked via USB, although it says 2.06.3 (110225.0) even though I used the 110420.0 file from their website, weird.

I looked at the latest firmware update and it seems the only difference is in the scripts in the main tekwayup_client/ folder. Binaries are the same according to my diff here for all three versions (5062B, 5102B, 5202B). I wonder why they are separating them now by model if all the binaries are the same.

You mentioned that another member here did some "looking" into the circuits and the code, so I suppose I should not invest time into it if that's going to be presented soon?

What we really need is Hex Rays ARM as that would give us pseudo code, rather than trying to guess through disassembly. Sadly, I do not have it and do not know anyone with it. Kinda pricey at that, too. :\

Someone else asked earlier in the thread about the 2.6.13 QQ2440 kernel source and that was a pain to find (just one source in China) but here it is for everyone else: http://mir.cr/DJHYUIHK
« Last Edit: May 28, 2011, 12:29:23 am by amigo »
 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #601 on: May 28, 2011, 01:37:34 am »
I was building a new workbench and my equipment was all stacked aside waiting for the build to finish. It just took sooooo long but here's the product of that labour:



heh, that's perfect excuse. Btw, on the pic, 4 x Xantrex/Sorensen power supply ? I like them, good value for money, especialy if you use gpib/uart.

Appears it worked via USB, although it says 2.06.3 (110225.0) even though I used the 110420.0 file from their website, weird.

yep, see the last 5 postings :) Just a "lazy" developer, binary if definitely from April 2011, so only version number not updated.

I looked at the latest firmware update and it seems the only difference is in the scripts in the main tekwayup_client/ folder. Binaries are the same according to my diff here for all
three versions (5062B, 5102B, 5202B). I wonder why they are separating them now by model if all the binaries are the same.
actually as there is new and old hw revision each update is checking first for hw model and then calling the child update script.
As there is routing diff between hardware revisions, in case firmware update includes fpga design (dn.rbf) you have to copy/use the proper one.
You will not kill the fpga by wrong design, but your DSO will not work proper.

And yes, there is no diff in binaries, however due the "hack protection" the update script need to be per model. Reason is very simple, the fw on the DSO is checking the content
of update file and comparing model names, if they match the update will continue. However this protection is mostly a joke, and it seems that HanTekway got pissed off by themself
so they implemented a secret way to skip model check (by the "special" file). However this only works if the fw version on the DSO know it (so must be at least 2.06.3 (110225.0)).
Anyway, as i heard they will soon have only single fw for all models, probably with better protection, which actually didn't really matter.

You mentioned that another member here did some "looking" into the circuits and the code, so I suppose I should not invest time into it if that's going to be presented soon?
What we really need is Hex Rays ARM as that would give us pseudo code, rather than trying to guess through disassembly. Sadly, I do not have it and do not know anyone with it. Kinda pricey at that, too. :\


i draw schematic (i still have to update some sheets from paper to sch) of the old hw revision (which is what you have), the member i mentioned
focused on firmware itself. He disassembled the firmware and analyzed deeper. However as asm analysis cost time he stopped and wrote
own arm decompiler (i think plugin for ida). For sure it might not work that good as Hex Rays, but defnitelly better than nothing (or pure asm).
To buy Hex Rays is not an option (not for single person).

He haven't published yet anything due private work load (so you can still spend some time analyzing too), no idea when he will be "ready",
but i'm bothering him all the time :)
« Last Edit: May 28, 2011, 02:10:41 am by tinhead »
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline amigo

  • Regular Contributor
  • *
  • Posts: 108
  • Professional Wannabe
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #602 on: May 28, 2011, 02:09:37 am »
heh, that's perfect excuse. Btw, on the pic, 4 x Xantrex/Sorensen power supply ? I like them, good value for money, especialy if you use gpib/uart.
Yup Sorensen - I got them for $200 on eBay, I think the best deal I ever got judging that you can hook these up parallel, serial, stand-alone. :)

Quote
...
so they implemented a secret way to skip model check (by the "special" file). However this only works if the fw version on the DSO know it (so must be at least 2.06.3 (110225.0)).
Anyway, as i heard they will soon have only single fw for all models, probably with better protection, which actually didn't really matter.
I agree with you all the way when you said they should focus on fixing bugs and not spending resources on protection as that's just going to make people even more interested to go around it. Just look at what's happening with the commercial software and "fancy" ways of protection that all failed miserably. But I guess Hantekway is trying to keep their shareholders happy, too bad the shareholders don't have much insight into it or they would probably long abandoned protections as they are futile.

Quote
i draw schematic (i still have to update some sheets from paper to sch) of the old hw revision (which is what you have), the member i mentioned
focused on firmware itself. He disassembled the firmware and analyzed deeper. However as asm analysis cost time he stopped and wrote
own arm decompiler (i think plugin for ida). For sure it might not work that good as Hex Rays, but defnitelly better than nothing (or pure asm).
To buy Hex Rays is not an option (not for single person).

He haven't published yet anything due private work load (so you can still spend some time analyzing too), no idea when he will be "ready",
but i'm bothering him all the time :)
He wrote a plugin to convert to pseudo code, that's impressive?!

I thought you wouldn't need a plugin to just disassemble with IDA because ARM is already supported, but can't generate pseudo code without Hex Rays ARM...

When can we see those schematics? :)

Say, I'm struggling here with the dumped image of the firmware. I thought we could mount the root.bin as a yaffs(2) but I'm getting nowhere with it? I managed to compile yaffs2 and got mtd-utils and yaffs2utils as well, but it keeps telling me it's not the right image or not a multiple of 2048+64?

I suppose you aren't using vanilla Linux for your debugging but instead the Mini2440 board?
 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #603 on: May 28, 2011, 02:33:39 am »
Yup Sorensen - I got them for $200 on eBay, I think the best deal I ever got judging that you can hook these up parallel, serial, stand-alone. :)

puhh, that's indeed good deal. I bough two (single units) for ~200USD total, however with gpib card which was still very cheap.

He wrote a plugin to convert to pseudo code, that's impressive?!

I thought you wouldn't need a plugin to just disassemble with IDA because ARM is already supported, but can't generate pseudo code without Hex Rays ARM...

to disassmeble IDA is enough, but to decompile back to C you need HexRays plugin (or DIY plugin/decompiler as he did, which is indeed impressive)


When can we see those schematics? :)

soon ...

Say, I'm struggling here with the dumped image of the firmware. I thought we could mount the root.bin as a yaffs(2) but I'm getting nowhere with it? I managed to compile yaffs2 and got mtd-utils and yaffs2utils as well, but it keeps telling me it's not the right image or not a multiple of 2048+64?

I suppose you aren't using vanilla Linux for your debugging but instead the Mini2440 board?

i'm not sure if yaffs2utils is working properly, as i remember there was problem with OOB and small NAND.
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline amigo

  • Regular Contributor
  • *
  • Posts: 108
  • Professional Wannabe
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #604 on: May 28, 2011, 02:51:05 am »
I'm just lazy to hook the FT232R up to the UART port and so I thought to dig through the file system by mounting the image. Maybe I should make a permanent port on the scope and just connect that way but then I have to keep the scope on as well, and I would be messing with a "live" system, too.

I'll figure this yaffs thing out, computers are not smarter than people - we made those suckers after all! :)

Thanks!
 

Offline jellytot

  • Contributor
  • Posts: 30
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #605 on: May 28, 2011, 06:35:02 am »
Well I`m not sure what I've done here, but I performed the upgrade on a Hantek DSO5102B
the latest model, but after I upgraded with the latest 5202 firmware I thought to change the logo back
to 5102, so I did and it booted with the 5102 logo but it also changed it to 5102 under system parameters
model type. >:(  So now I was worried and decided to change the logo back to 5202 again,but the boot screen has still got the 5102 logo but the system parameter display is now DSO5202B.
So I thought that maybe to rerun the firmware update again to bring the boot logo back.. :) but the update
failed at stage 8 with the error message "software upgrade failed error 0xf7  Illegal upgrade files detected"
So now I'm worried that I wont be able to upgrade with future updates?? So how serious is it ? will a new upgrade work? Thanks.
 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #606 on: May 28, 2011, 10:51:32 am »
So now I'm worried that I wont be able to upgrade with future updates?? So how serious is it ? will a new upgrade work? Thanks.
you did something wrong, but don't worry, you can't brick HanTekway DSO that easy.

Did you hacked over UART or USB? The best would be to connect via UART and to control
all files (/logotype, /logotype.dis, /tmpdst, /dstxxxxb)
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline jellytot

  • Contributor
  • Posts: 30
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #607 on: May 28, 2011, 12:16:10 pm »
Hi Tinhead. Yes I had followed exactly the instructions at the beginning using the uart method and everything worked great. It was only when after the upgrade that I edited the last setting to change the boot logo
back to DSO5102B that I ran into problems where I could not change it back. I tried to edit the files but they are already edited to use DSO5202B. It was Then I thought to run the same new firmware release, thinking that It would bring the logo back and thats were I got the error message. It looks like its running as a DSO5202B though as the band width goes to 2ns  :)  But I`m just worried that it wont take a future update, or is it that the firmware wont overwrite itself. Is it possible to fix ? I didnt think changing a logo would cause the problem >:(

 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #608 on: May 28, 2011, 01:11:10 pm »
if all files are ref. to 200Mhz:

logotype = dst1202b
logotype.dis = hantek_dso5202b
tmpdst = /dst1202b
/dst1202b

then you don't have to worry. After the hack you to use of course dso5202b firmware update files, it should not
give you an error if all these files in above are correct.

Check all these files, edit sys.inf like

[DST type]
[soft version]
[fpga version]
[start time]-1
[update time]-1

and reboot again.
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline jellytot

  • Contributor
  • Posts: 30
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #609 on: May 28, 2011, 01:47:03 pm »
Hi Tinhead. I Still have the problem! as far as I can tell the files are correctly edited but I still get the error ?
is it possible to flash again with the same firmware ?

model DSO5202B
soft version 2.06.3 (110225.0)
hard version 10050x555583e9
s/n T1G/005 xxxxxx 

here is a log of the process. Sorry its so long I edited it places to shorten..
it stops at ierror :247  ??

*** in doing do_update_secret_packet ***
<>get key=134.
(012)mem valid cnt=547..time 10s wave frames = 18...
iUpdateErrCode : 0
have * in update packet
Search_UdiskUpdateXXXFiles
dst1kb_2.06.3_15202b_fact(110420.0).up
(013)mem valid cnt=547..time 10s wave frames = 0...
(014)mem valid cnt=547..time 10s wave frames = 0...
tmp_name : /usr/up/dst1000_4000.up.tmp
gpg: CAST5 encrypted data
pw:0571tekway
gpg: encrypted with 1 passphrase
(015)mem valid cnt=547..time 10s wave frames = 0...
gpg: WARNING: message was not integrity protected
gpg: CAST5 encrypted data
pw:0571tekway
gpg: encrypted with 1 passphrase
(016)mem valid cnt=547..time 10s wave frames = 0...
gpg: WARNING: message was not integrity protected
dst1kb_2.06.3_.up.tar
(017)mem valid cnt=547..time 10s wave frames = 0...
tekwayup_client
tekwayup_client/update.sh
tekwayup_client/update
tekwayup_client/readHWVersion
tekwayup_client/update~
tekwayup_client/boardzero
tekwayup_client/boardzero/dso-lcd.ko
tekwayup_client/boardzero/updatezero.sh
tekwayup_client/boardzero/updatezero.sh~
tekwayup_client/update.sh~
tekwayup_client/sys.inf
tekwayup_client/logotype.dis
tekwayup_client/sys.inf~
tekwayup_client/common
tekwayup_client/common/logo
tekwayup_client/common/logo/hantek_DSO5062B_up.ico
(018)mem valid cnt=547..time 10s wave frames = 0...
tekwayup_client/common/logo/hantek_DSO5062B_mid.ico

tekwayup_client/common/libiconv.so.2.3.0
tekwayup_client/common/help.db
tekwayup_client/common/dso.exe
(019)mem valid cnt=547..time 10s wave frames = 0...
tekwayup_client/common/OurLanguages
tekwayup_client/common/OurLanguages/Tridchn.lan

tekwayup_client/common/OurLanguages/English.lan
tekwayup_client/common/updatecom.sh
tekwayup_client/common/updatecom.sh~
tekwayup_client/board1005
tekwayup_client/board1005/dso-lcd.ko
tekwayup_client/board1005/dso-buzzer.ko
tekwayup_client/board1005/update1005.sh
tekwayup_client/board1005/update1005.sh~
upend
Tar_UpdatePacket ok !!
start update sys files
ucUpdateBrand:hantek
ucSysBrand:hantek
ucUpdateType:DSO5202B
ucSysType:DSO5202B
iError :247

Draw_SingleMenuItem() <disp/menu_disp.c,2569>: 9682896.
(020)mem valid cnt=547..time 10s wave frames = 0...

Please press Enter to activate this console.


 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #610 on: May 28, 2011, 02:06:59 pm »
there must be some special character in the logotype.dis, visualy the compare seems to be ok

ucUpdateBrand:hantek
ucSysBrand:hantek
ucUpdateType:DSO5202B
ucSysType:DSO5202B
iError :247

take the attached file, unzip to usb stick, insert stick and move to / of the DSO.
Then reboot and try update again (and yes, you can run update over and over again)
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline jellytot

  • Contributor
  • Posts: 30
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #611 on: May 28, 2011, 02:56:02 pm »
Well Tinhead. You certainly know this instrument  8)  All working fine now  ;D I'm very grateful for your help
with this, I was sure that there was new protection employed in the new firmware...But now I`ll leave well enough alone and just apply the updates when they are released. so what do you think had happened, some corruption when I done the editing or something else? So the boot logo is critical when it comes to applying
firmware updates..? Thankyou once again.
 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #612 on: May 28, 2011, 06:20:04 pm »
you welcome.

Regards the logo, it might be safer to rename the logo files itself (look in /logo directory) instead of changing
the logotype.dis (which will be actually read by the lcd driver to assign proper logo).
The reason is very simple, this file will be also used for model versification during firmware update, so if you have there
some wrong characters (like CR) the compare will always fail and you will be not able to do any fw updates.

I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline amigo

  • Regular Contributor
  • *
  • Posts: 108
  • Professional Wannabe
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #613 on: May 28, 2011, 06:32:44 pm »
tinhead,

slightly off topic, but do you ever sleep? :)

I envy your passion and ability to stay up non-stop if you never sleep! :D
 

Offline dfnr2

  • Regular Contributor
  • *
  • Posts: 228
  • Country: us
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #614 on: May 28, 2011, 06:42:20 pm »




Just for the record, that's really a beautiful setup.

Dave
 

Offline amigo

  • Regular Contributor
  • *
  • Posts: 108
  • Professional Wannabe
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #615 on: May 28, 2011, 06:56:36 pm »
Just for the record, that's really a beautiful setup.

Dave
Thanks Dave, here's a bit wider view of that side of the room.



The workbench was a real pain to build and took me months (it was build in that room). I had no plans just a sketch and some wild idea of what I'd like it to look like. It did go through couple of design changes in my head and ended up like this. The two shelfs on top are separate and detach as well as the legs of the bench and the shelf beneath, else none of this could enter or leave the room (too wide/big for the door frame). :D
 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #616 on: May 28, 2011, 09:18:53 pm »
tinhead,

slightly off topic, but do you ever sleep? :)

I envy your passion and ability to stay up non-stop if you never sleep! :D

i did the "worst" thing human being can do - turned hobby into my job.
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline amigo

  • Regular Contributor
  • *
  • Posts: 108
  • Professional Wannabe
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #617 on: May 28, 2011, 09:56:49 pm »
i did the "worst" thing human being can do - turned hobby into my job.

You are right about the worst thing, as I know from my personal experience that all the hobbies I turned into jobs became laborious and I ended up disliking them. Electronics is still a hobby so I put up with it! :D
 

Offline jellytot

  • Contributor
  • Posts: 30
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #618 on: May 29, 2011, 01:25:46 am »
That old adage "do something you love and you'll never work a day in your life" isn't exactly true, more like
99% persperation 1% inspiration  ;D still its the satisfaction of finding out what caused the problem and then seeing it work again that motivates, its either that or a form of ocd  ;D
 

Offline ECL

  • Contributor
  • Posts: 14
  • Country: us
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #619 on: June 13, 2011, 09:03:11 am »

I finally got a chance to wire in an RS-232 translator, and do the hack.
Everything when quite smooth, thanks to the up-to-date summary, on the first page
(thanks tinhead  :)).  My firmware image did not have logo files, for the DSO5202B.  I
downloaded them from the link on page 14, and copied them to the scope, using
a flash drive:

https://www.eevblog.com/forum/index.php?topic=1571.msg32924#msg32924

That was the only step missing from the summary.  It might be useful to add a
link to logo files, on the first page.

While scanning the (post-hack) console output, during boot, I noticed the following:

now run app .....
main///////////////////////////////////////////////////////////////////////////////////////
link_autocheck_event......Complete!
mkdir: Cannot create directory `/param': File exists
mkdir: Cannot create directory `/param/sav': File exists
Kernel version = 0904100...
init kernel event ......[ok].
bank dso
init PC_UART_EVENT......[ok].
found /dst* =
 /dst1202b

DSTtype= dst1202b
maxSps = 2
bandWidth = 20
bandWidth = 6
 ###  CheckFileIsExist.  failled.
link_autocheck_event......Complete!
   

Note the two bandWidth listings.  I have a Hantek DSO5062B, with firmware = 2.06.2 (101108.0).
Before the hack, this was the output:

now run app .....
main///////////////////////////////////////////////////////////////////////////////////////
link_autocheck_event......Complete!
mkdir: Cannot create directory `/param': File exists
mkdir: Cannot create directory `/param/sav': File exists
Kernel version = 0904100...
init kernel event ......[ok].
bank dso
init PC_UART_EVENT......[ok].
found /dst* =
 /dst1062b

DSTtype= dst1062b
maxSps = 2
bandWidth = 06
bandWidth = 2
 ###  CheckFileIsExist.  failled.
link_autocheck_event......Complete!
 

Anyone know what the second bandwidth listing is all about?

Lastly, any strong opinions on the latest firmware?  Better/worse vs. 2.06.2 (101108.0)?

Thanks,

ECL  -K 
 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #620 on: June 13, 2011, 12:12:43 pm »
simple, there is a array with possible bandwidth values,  

[0..6] '02  04  06  08  10  15  20'

so we have 20, 40, 60, 80, 100, 150 and 200MHz.

If the model is set to DST1062B we have 60MHz bw, so the value 06 is selected
which is second value in the array and with DST1202 we have 200MHz, so value 20 which
is the last, also 6th value from the array.

This array will be used to specify the bw filter corner frequency.


Regards the fw version, well hard to say, i remember there are some ugly bugs in 2.6.2,
so it might make sense to update to latest (which have already some bug fixed, but still crashing in measurment-> help menu and
after few minutes when trigger selected to alt. )

« Last Edit: June 13, 2011, 12:14:46 pm by tinhead »
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline carloscuev

  • Regular Contributor
  • *
  • Posts: 122
  • Country: mx
    • Spanish Freescale Developers Forum
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #621 on: June 13, 2011, 03:04:54 pm »
Hello, could somebody share the latest firmware (for a 100 to 200 Mhz hacked DSO), I sent an Email to Tekway but they did not replied and would like to test the new firmware. Thanks !
 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #622 on: June 14, 2011, 03:09:06 pm »
Hello, could somebody share the latest firmware (for a 100 to 200 Mhz hacked DSO), I sent an Email to Tekway but they did not replied and would like to test the new firmware. Thanks !

same here, waitng since two weeks and no answer. I know they have some webserver issues, so maybe non of the emails will
get read, let me check with distir here, maybe they know more ...
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline tinhead

  • Super Contributor
  • ***
  • Posts: 1903
  • Country: 00
    • If you like my hacks, send me a donation
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #623 on: June 14, 2011, 07:00:21 pm »
About Factory Calibration

as you maybe know the factory calibration data is used by each Hantek/Tekway DSO to calculate
the self-calibration results agains specific hardware tolerance.

Sure, without this data the DSO will be able to run self-calibration, but you can be sure
the measured results will be wrong and over 5-10Mhz the ADC/FPGA timing constraint will not
work anymore, so you will see only crap on the display (actually they will be not run synchronous)

This factory calibration data is of course unique, each DSO have own due hardware tolerance.

There are (by default) following files on the file system:

tdc_edge125M - this is calibration for Edge Trigger by 1GSs (so each ADC in 125MHz)
tdc_overtime125M - this is calibration for Overtime Trigger by 1GSs (so each ADC in 125MHz)
tdc_pulse125M - this is calibration for Pulse Trigger by 1GSs (so each ADC in 125MHz)
mult_adc.log - this is the timing constraint table created from files above (more or less)
tdc.log

the first 4 files will get generated at factory, the 5th file (tdc.log) during self-calibration based on measured data recalculated
with data from the first 4 files.

In principle, if you do some changes to hardware, like input circuit changes, or clock oscillator changes
or even in some case you resolder something the factory calibration data need to be re-created.
And yeah, imagine if you have no warranty anymore and the NAND flash died, you will need this data
to be re-created too.

Btw, someone asked already before if there is a chance to reduce the waveform interferences,
well actually yes. By default the HanTekway DSOs are using standard quarz oscillators,
from all the models/hardware revisions over the time i know they typically specified somewhere
between 150ps up to 250ps total jitter. The FPGA pin (clock output to ADCs) jitter, as already mentioned in Rigol thread
is constant - however the calculation is based on the input clock quality (which is coming from the quarz oscillator).
This means if the clock signal have 30ps total jitter we have max 650ps jitter on ADC clock,
with 250ps input clock jitter you can calculate how the ADC clock looks like.

I did replaced my quarz oscillator, by low jitter model - FXO-HC736R-100 from Fox Electronics (digikey 631-1176-1-ND),
this baby have only ~25ps total jitter which is already below Altera specs.
However, it is not enough to change this part, the factory calibration need to be executed / re-created.
Therefore i looked around and found that Tekway/Hantek implemented the factory calibration procedure
into the firmware, as a hidden menu.

Now, with the /tst file hack (set to 300MHz bw) the waveform (100MHz test signal) looks like before with 100MHz bw,
where of course most of the HF distortion was removed. So in principe it is much better now, especially
for HF signals. This is still far from perfect but to be very honest there is no way to do it better,
except you design clock domain from scratch, as small addon boards placed directly near ADCs,
which isn't that easy.


How to run/restore Factory Calibration
You will need 10MHz (can be something between 1 and 20MHz, i got best results with 10MHz)
SQUARE signal source. Of course a good one, with low jitter (at least as good as your quarz oscillator used in your DSO)

Don't try to do it with sinus source, it will work for overtime and evt. for edge, but not for pulse calibration.
The necessary rise time can be something between 1ns - 20ns, i got best results with 5ns rise time.

And that's the factory calibration steps :

connect via UART to DSO
kill the dso application by typing
killall dso.exe

If you wish only to play around/test how this work, copy these files somewhere (stick, separate directory)
tdc.log
tdc_edge125M
tdc_edge (if exists, this files is really optional so don't care if you don't have it)
tdc_overtime125M
tdc_overtime  (if exists, this files is really optional so don't care if you don't have it)
tdc_pulse125M
tdc_pulse (if exists, this files is really optional so don't care if you don't have it)
mult_adc.log

You can restore them and everything will be as before (evt. you need to run after restored these files
and RESTARTED your DSO the self calibration once)

create /tdc.new file, by typing
touch /tdc.new

run on the shell (over UART/Terminal) the dso application by typing
/dso.exe

connect 10MHz low jitter square generator to channel 1

Click once "default setup", click once "Autoset",

Go to channel 1 settings, select coupling AC, go to trigger menu
and select Coupling AC, click once Trigger level knob to set trigger to ZERO line.

Select horizontal res. to 4ns/DIV.

Evt. increase the 10MHz aplitude, best distortion results are with aplitude over 8 div,
best small signal result with amplitude over 2 div - you can test what works better for your DSO/needs.

Now we ready for manufacturer calibration. Note that the DSO need some of these steps or it
will not let you re-create the manufacturer calibration files. The AC trigger and AC input
are optional, but as the calibration is checking zerocrossing it make sense to set like this.
You can of course do DC, but then your generator need to create +- waveform.

Now go to trigger menu, select type Edge, now click multiple time (fast) the "trigger Menu" button.
You should get an hidden window displayed.

Select F1 to continue, if you get "force quit!!!" message some of the settings are wrong, start from beginning :)

If everything fine the DSO will display

Creating TDC(1GSps)
Push KEY_F0 to force quit!!!


just wait until is it ready (a minute max.)

now select trigger type to pulse, open second page (F6)
and select "=" and pulse width of your test signal (so for 10MHz 50ns). As we in 4ns/DIV the next possible value
is 48ns, however you can change the horizontal res. to 20ns/DIV, select pulse Width to 50ns and select back the
horizontal res. to 4ns/DIV.

Now again click multiple time (fast) the key "trigger menu", again hidden menu will get displayed, select there F1.

If everything fine the DSO will display

Creating TDC(1GSps)
Push KEY_F0 to force quit!!!


just wait until is it ready (a minute max.)

now select trigger type to O.T. (over time) and select lowest overtime value (should be 24ns)

Now again click multiple time (fast) the key "trigger menu", again hidden menu will get displayed, select there F1.

If everything fine the DSO will display

Creating TDC(1GSps)
Push KEY_F0 to force quit!!!


just wait until is it ready (a minute max.)

That's all, the DSO have now created all necessary factory calibration files.

Now you can disconnect the 10MHz signal generator and run self-calibration.

You can reply all these steps to get best results.

Finally, if you happy, delete the tdc.new file by
rm /tdc.new

or by clicking multiple time (fast) the key "trigger menu" and selecting there F3 from the hidden menu.

what else ...

During the factory calibration the firmware is automaitcally re-loading the created files, so you don't haev to restart the DSO
to run self-calibration.

However, if you break up the factory calibration or wish only to test it, you will need to reboot DSO to reload
your original data (which of course need to be restored first as mentioned above).

The good thing is, you can't damage HanTekway DSO, the linux OS makes backup/restore easy,
now as we know how factory calibration works we can play with whatever we wish (except CPLD programming
which can't be restored - but Hantek have no issues at all to sell/send you replacement CPLD).
« Last Edit: June 14, 2011, 08:20:13 pm by tinhead »
I don't want to be human! I want to see gamma rays, I want to hear X-rays, and I want to smell dark matter ...
I want to reach out with something other than these prehensile paws and feel the solar wind of a supernova flowing over me.
 

Offline ECL

  • Contributor
  • Posts: 14
  • Country: us
Re: Hantek - Tekway - DSO hack - get 200MHz bw for free
« Reply #624 on: June 14, 2011, 07:19:29 pm »
simple, there is a array with possible bandwidth values, 

[0..6] '02  04  06  08  10  15  20'

so we have 20, 40, 60, 80, 100, 150 and 200MHz.

If the model is set to DST1062B we have 60MHz bw, so the value 06 is selected
which is second value in the array and with DST1202 we have 200MHz, so value 20 which
is the last, also 6th value from the array.

This array will be used to specify the bw filter corner frequency.

Ah, yes, that makes sense, thanks!  :)

Regards the fw version, well hard to say, i remember there are some ugly bugs in 2.6.2,
so it might make sense to update to latest (which have already some bug fixed, but still crashing in measurment-> help menu and
after few minutes when trigger selected to alt. )

Thanks, I think I will give the upgrade a whirl.  2.6.2 is okay, but I've gotten it to crash
as well.  Hopefully Hantek/Tekway will fix the crashing bugs soon.  I can live with buggy
software, but lock-ups are a big no-no ...  :)

ECL  -K
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf