Upgrading the Hantek DSO4072C and DS4104C oscilloscopes bandwidth up to 250MHz

[Microcheap]

So, I got one of these cheap 4072C to play and then decided to see if it was possible to hack it from its original 70MHz to the 200MHz maximum bandwidth. I successfully managed to re-config it and found that it is rather simple, it is very similar to the other Hantek hacks with just a small different detail. Here is how I did it, if anyone is interested:

1 - You need to open the case to get access to the serial interface on the PCB, it is located beside the usb connector and the pinout is the same as the others, from the usb connector the pins are: unused, RX, TX , GND and 3v3 (not needed).
2 - Connect the cables to an USB-TTL converter and on your pc open the terminal emulator of your choice (I use Poderosa 4). Open a serial connection with the configuration 115200bps and 8-n-1.
3 - Turn on the oscilloscope and wait for the boot. Before change anything I did a full backup using the tool nandbackup_V2 provided by @fremen67 here (just extract the files to an usb flash drive, plug it to the scope and execute the script, i did ./nandbackup_1.00.2_OOB and ./nandbackup_1.00.2 just in case, it will take about 15min each).
4 - Now, to change the bandwidth you need edit just one line in the file i2c.log located in / (I would recommend you to make a copy of it to your flash drive as well). Open the file with the vi editor and change the last line: where you see [bw] 70 to [bw] 200 to get the 200MHz or [bw] 100 to 100MHz. Save and close.
5 - Now reboot the scope typing the command reboot [enter] (if you just turn off and on the scope, it won't work), and that's it

Opening the menu Utility -> System Info you should see the model changed to DSO4202C.

To be honest, I am not sure if there is really any difference among the models. I don't have a function generator or other equipment capable of test the full bandwidth, my hacked HDG2002B is useful up to just about 50/60 MHz so I couldn't see any practical change after the upgrade, if anyone could test it and confirm, I would be grateful.

Some pictures

[Microcheap]

Some other pictures

[Microcheap]

I understand that there is not much interest in these cheap Chinese equipment manufacturers, so I will keep the information in one thread only to not pollute the forum, just in case someone ever looks for it, they will be able to find it here.

So, I borrowed the newer model of the Hantek scope with 4 channels (DSO4104C) to try the same upgrade as above and indeed it works. The 2ch model goes up to 200MHz only but the new 4ch has a 250MHz version: http://www.hantek.com/en/ProductDetail_3_12167.html

The procedure is the same as described in the first post, the only difference is in the file to be changed. To get the full 250MHz bandwidth, edit the file system.inf located in /config/root and change the first line "Model=80M$DSO4084C" if you have the 80MHz or "Model=100M$DSO4104C" for the 100MHz to Model=250M$DSO4254C, save and reboot.

If someone is able to test and confirm it would be nice, as I don't have the equipment to test the effectiveness of this upgrade or the real performance of these oscilloscopes measuring maximum bandwidth.

[Microcheap]

Some more pictures

[rlohmann]

Just a small question, could you provide a closer photo from the wave gen output? 

I'm wondering which IC is placed at U63 (and if possible the diode D1501). 

I'm curious if simply adding a IC, diode and BNC would enable the wave gen on DSO4004B ... (the according GUI is already available in my case)

[tsman]

If it is anything like the AWG output on a handheld 2000 series then it is a LMH6702 opamp. Pinout looks correct. Probe the input pin to that opamp to see if there is any signal when you activate the AWG. If there is a signal then start pondering what parts to get.

[rlohmann]

Thanks for the hint. Nope, no signal around. 

Perhaps, a DAC or some SW is also missing.

I'll leave it as it is for now and maybe get back to that topic later on ...

[Microcheap]

Sorry, I don't have the the scope with me anymore, it was a borrowed unit, but the output OpAmp U63 is a EL5166ISZ https://www.mouser.ie/ProductDetail/Renesas-Intersil/EL5166ISZ?qs=sGAEpiMZZMsko7UDAsUSISfAG4JYqL3li7G7U2Q8z3U%3d

D1501 is probably a clamping diode BAV99 (marking code A7). Check U62 too, it is a DAC902E, it is not a cheap iC, so I suppose it is not populated in your board as well.

[rlohmann]

Thanks a lot for the detailed information!   

Just order a few components, just to see (for fun) if I can get the signal gen to work. 

[Microcheap]

Nice, please report back your results.
I was wondering if there is also the need to change some configuration in the software to enable the AWG. On the 2CH models, in the file i2c.log there is a line "[dds]" set to 1 that i suppose tells the scope software to activate the function generator option, but I didn't find anything like this in the 4104C, maybe just changing the "B" from the DSO4XX4B to a "C" in the file system.inf will do the trick, but it need to be tested.

[rlohmann]

Sure, will be my pleasure to keep you and this thread updated!   

And thank you again for all your helpful comments and information!   

[zoran]

I can confirm that the bandwidth hack really work.   
Today I hacked my Hantek DSO4104B and it has now -3 dB point at around 280 MHz. You can even observe signals beyond 300 MHz.
The upper limit is not exact as I used an old LSV-350 VHF Sweep generator. Still, it is very obvious that the input station of the oscilloscope permit signals higher than 250 MHz.

Microcheap gave us good information at the beginning post so I can only add minor remarks:
You can find information on how to open the oscilloscope at https://youtu.be/fxgJdKeOmlo
You have to pull the black power ON button cap from the outside before you open the oscilloscope. Use some cloth between pliers and plastic cap to prevent scratches.
Info on serial connector is at: https://youtu.be/fxgJdKeOmlo?t=1921
RX goes to TX of the USB-TTL converter
TX goes to RX of the USB-TTL converter
Ground goes to converters ground.
For the terminal emulator, you can also use Putty as it is available on all platforms.
The DSO4104B is almost perfect budget oscilloscope for basic or should I say classic tasks and it is nice that it can be even a little better now

[tom66]

I'm curious what that SATA cable goes to on the main board there? Does the unit have a disk drive?

[zoran]

No, I don't think that SATA cable is for the disk.
They use SATA cable to connect the main board with I/O board at the back of the case that has network and USB sockets. At the back can be also mounted HDMI socket.
It is interesting to see a memory card slot located at the edge of the main board.

[Microcheap]

I can confirm that the bandwidth hack really work.   

That's good to hear, thx for the confirmation zoran

[rlohmann]

Hi all,

I finally received the missing ICs required to get the function generator to life.

Two items I notices, hoping someone could help me with ...

I noticed that some resistor arrays (RA1601-RA1604) close to the DAC (U62) are missing. Does anybody know the used resistance?

I also ordered a BNC-connector by guessing, but noticed it does not fit. Does anybody has part number for those?

[tinhead]

these not populated Relais for 50R input, they asking to get populated ^^ Wondering only if you guys change the model number, the 50R will get enabled in firmware?

[Microcheap]

I noticed that some resistor arrays (RA1601-RA1604) close to the DAC (U62) are missing. Does anybody know the used resistance?

I found some pictures I took when I disassembled my scope, I hope it will be helpful.

[rlohmann]

Hi just schort update.

It took a while to get the parts and the time to put them together.

But finally, after adding the missing parts:

 - DAC902E (U62)
 - 4x 20Rx4 (RA1601-RA1604)

 - EL5166ISZ (U63)
 - BAV99 (D1501)

 - and a somewhat fitting BNC-connector,

and the function generator appears to work.

Only the bandwidth seems to be low.
Sinus looses amplitude @ f > 1Mhz (as I remember) ... Will look into that later on.


 

[Microcheap]

The problem may be calibration. There is a file called dds_calbration.dat (sic) in the folder /config/root that I suppose contains calibration data for the function generator. The calibration is made at the factory, and I think the devices without DDS option won't have this file. I don't know if it is possible to calibrate de DDS later but you can try to copy the file from another device, obviously it is not ideal, as this calibration data is unique for each device but it may improve things a bit.

[bianchifan]

But finally, after adding the missing parts:

 - DAC902E (U62)

Are you shure it's the correct one?

When looking at the (not really sharp) pics all 14! data lines bit 1 thru 14 seem connected.
Compared to my shortly arrived 6074, where bits 13 and 14 are not!
So maybe DAC904 is used at DSO40nn...

[Microcheap]

Are you shure it's the correct one?

Yes, the DSO4004C series uses DAC902E and, as far as I know, the 6074BC used it as well, unless Hantek has changed it in a new PCB revision.
For the new Hantek2000 series devices, Hantek is using now a Chinese DAC (made by 3Peak) but, it is pin compatible with the DAC902E.

[tkoop]

I've just checked on my scope. On the left resistor network is only the clock signal active.

[Muellmann]

I recently bought a Hantek DSO4084C and did the upgrade to DSO4254C.
The Info screen now shows the upgraded model but it seems not really work on 250MHz.

When I set 20ns timebase I see the signal with high time resolution (amazing!). When I switch to 10ns to take a closer look the waveform shows this with higher resolution and suddenly jumps to a filtered one (frustrating!). So obviously the software does not fully recognize the Model cheating.

I'm using:
Software 1.1.2(190701.0)
Hardware 501 001.001.000.000.000.000.000
FPGA a005

Does anybody know how to fix this behaviour? Did I miss something in hacking? Should I use an older firmware (is a downgrade possible?)?

Rainer

[W1ZZT3XX]

Do you maybe have the AutoRange enabled?
Check that AutoScale -> AutoRange is OFF.

I did the same as you did and converted a DSO4084B to a DSO4254C. Everything went fine so far. The signal stays stable even at 200 MHz. I use the same specs You do.

I wrote a little hacking summary, that I will attach as pdf.

Edit: Uploaded updated hacking manual with added EEPROM hack. You can always see the current document on my github .

[Muellmann]

thank's for the very detailled hacking manual. This is very condensed all information at one place.

I again did some tests with my hacked DSO and I'm afraid I did some measurement mistakes. After I double check the tests I can't reproduce the result. The signal I used was a STM32H7 IO pin measured with a 300MHz probe.
I will intermit my reseach until I have a suitable signal. Therefore I will build this circuit: https://www.analog.com/en/design-center/reference-designs/circuit-collections/lt1721-pulse-generator-has-0ns-to-10ns-width-520ps-transitions.html.

I will compare with a calibrated 200MHz Agilent DSO I have at work and will come back after this measurements with more pictures.

[Microcheap]

I wrote a little hacking summary, that I will attach as pdf.

Nice job with the pdf, a lot of details. 

[W1ZZT3XX]

Hey guys. Thank You for Your positive feedback!

I kept trying out a little bit and found out one more point that seems to be important - the EEPROM!

Mine is a MICROCHIP one marked with 4L64I. The manufacturer's datasheet (http://ww1.microchip.com/downloads/en/devicedoc/21189f.pdf) says on p. 13, that it is a 24LC64 I²C device ( 8K x 8 ).
So I cross-compiled the linux i²c tools and read it out with eeprog

Code: [Select]

./eeprog /dev/i2c-0 0x50 -r 0x0000:0x2000 -16 > EEPROM.binYou can find it at https://github.com/WiZZteXX/DSO4xx4c/blob/master/EEPROM.bin. Here comes the plot:

They programmed the bandwidth from 0x0006 in as "80M" . By just wanting to know what happens, i desoldered the EEPROM - no difference. By reading the startup outputs, which say that the scope is 250M i guess that it is just a kind of backup.
What else is coded:
The [Lans] value starting at 0x020c and the [Language] value starting at 0x0216. That's it. No serial number. The rest are patterns of 0x00's and 0xFF's. The funny thing about this is, that they updated the [Lans] in their last update to 255 - but the did not change it in the EEPROM.

Unfortunately, it would not be the first time a Chinese company hard-copies some stuff and later tries to use it to deactivate the device (had that experience with a hacked MiniPRO EEPROM programmer, too). So better be careful with updates, until this is cleared!

So I am of course interested in changing the values to the current settings, but I am not sure, if 3-digit bandwidth values would also start @ 0x0006 or already at 0x0005. Maybe someone, who bought a 100 MHz scope could read out the EEPROM and tell me that. I would then script a shell file that corrects the value using the i²c tools. I uploaded the compiled tools to https://github.com/WiZZteXX/DSO4xx4c/tree/i2c-tools/usr/ so you can simply copy them to a flash drive an run the instruction mentioned before.

I just made a simple test: I first modified the EEPROM starting at 0x0005 to "250M" and renamed the /dso/root/system.inf. Starting the device and checking the bootlog it said, it is 50M. So i just cropped the 2.
Next try: I wrote the "250M" starting at 0x0006 and once more deleted the newly created system.inf.
The scope autocreated a new /dso/root/system.inf as a kind of template with the speed "250M" added (see attachment). 
So to complete the hacking process You will also have to change the eeprom contents as follows:

1 .Download the compiled i²c tools from my  github and save them to a flash drive.

2. Open the scope and start a terminal as described in pt. 3 of my Hacking guide

3. Run the following instructions

Code: [Select]

cd /mnt/udisk/usr/local/sbin
cat 250M | ./eeprog /dev/i2c-0 0x50 -f -w 0x0006 -16
./eeprog /dev/i2c-0 0x50 -f -w 0x0000:16 -16(The file 250M just contains the string "250M" without any control signals what makes it easier than an echo instruction)

4. The last output should now show the hex values for 250M like this:

Code: [Select]

0000| 00 00 00 00 00 00 32 35    30 4d 00 00 00 00 00 00

The scope should now be hacked completely

and should be safe for future updates. 

[/list]

I will compare with a calibrated 200MHz Agilent DSO I have at work and will come back after this measurements with more pictures.

I am really interested in the results!

[Microcheap]

I don't think that any change in the EEPROM is needed to change the BW. I measured the rise time of a pulse signal and used it to calculate the bandwidth of the scope with only the system.inf modification and the results are clear.

First, the original 100MHz, the rise time is about 3.5ns, calculating BW=0.35/trise => 100MHz


Now changing only the system.inf file to 250MHz, the rise time is clearly faster, about 2ns. Note that if solving the equation above the BW is only 175MHz, but that is a limitation of the pulse of my generator, I would need a faster pulse


Obs. Measured connecting the pulse of the sync output of my function generator to the oscilloscope using coax cable and a 50ohm feedthrough in the scope input.

[W1ZZT3XX]

Sorry if i misexpressed myself.   

I did not want to claim, that it changes the bandwith, because this is indeed only done by changing the Model value of system.inf.

My thought was another one:
If I was the vendor of those DSOs, I'd try to do something against hacking in some update-
My personal way would be to reset the samplerate to the one from the EEPROM and lock the serial port. So I saw it as a kind of "preventive measure" againt upcoming anti-hacking software updates, because now the DSO even to the software looks like a real DSO4254B/C and i can keep it updatable.

As You can see in the screenshot below that was taken before the EEPROM hack it was the same for me - rise time about 2ns (It is the ADC CLK signal @ 200 MHz)

[Muellmann]

I got the LT1721CGN + SN74AHC1G08DBVR and soldered my Pulse Generator Board. I some did measurements with an Agilent DSO-X 3024A (200MHz bandwidth) and my hacked DSO4084C (250MHz bandwidth). I measured with the same 300MHz 1:10 Agilent probe. I compensated it individually to each scope before doing the measurement.

Sad to say the pulse generator is not as good as LT promised. They told it should have 560ps rise time but I can measure only about 2ns. No surprise, the datasheet of the AHC08 (the output stage) says risetime with 15pF load: min 1ns, max 7ns. The measured 2ns seems to be a good value with my ugly wireing.

Both oszilloscopes showed nearly the same shape with the same rise time, for 2ns only about 170MHz bandwidth is neccessary to measure. So far, so good.
To fully check for the bandwidth limit I still need a better generator. Maybe I can get a 250,000000 MHZ TCXO Oscillator chip to do more measurements...

[DEBO]

Hi, the DSO4072C model has been superseded with the DSO4072S. I went to buy one from Aliexpress and found this in the description "Note:  Older model is DSO4072C now update to DSO4072S , the function is the same . what we sent is DSO4072S new version" .

Has anyone received the new model yet?  Is it still hackable?

[Microcheap]

I think they are exactly the same, the "S" version could have been rebadged by some distributor for the Chinese market only. If you check Hantek's website there's no mention about this "s" model.

https://www.eediscuss.com/forum.php?mod=viewthread&tid=14958

[kuken]

I bought a damaged Voltcraft DSO-1084E oscilloscope, it was hanging on the boot screen. I was able to fix it and then I found this topic and decided to run the built-in generator and extend the frequency to 250MHz. I modified my oscilloscope according to the description in PDF, very good description. Not calibrating yet generator, then started it to check if it generates anything, connected CH1 to out gen and in the whole range up to 25MHz the generator works, but not exactly, the amplitude is too low and the frequency jumps slightly. I decided calibrate it. However, when trying to calibrate, DDS calibrate amp filed. I bought the parts on Aliexpress. What could be wrong, any suggestions? 

After push calibrate button, UART shows:

[root@Hantek ~]#anolis_widget_rect:394 widget!=NULL&&rect!=NULL failed.
util_thread_pause:thread 0x9fd0f0 is paused
util_thread_pause:thread 0x9ec690 is paused
acq_dot_nm_of_timerange =4000,time_range=3200000000,dso_acq.dot_factor =1,sample_rate =1250000.000000
dso_acq_control:1:2056, 2056,0
dso_acq_control:2:2056, 2056
dso_acq_control:3:205600, 207200
dso_acq_control:4:after= 205600, before= 207200
acq_dot_nm_of_timerange =4000,time_range=3200000000,dso_acq.dot_factor =1,sample_rate =1250000.000000
dso_acq_control:1:2056, 2056,0
dso_acq_control:2:2056, 2056
dso_acq_control:3:205600, 207200
dso_acq_control:4:after= 205600, before= 207200
measure_helper_set_one_chn_all_only:0
dds_calibrate_uniformlize_offset:0x100011
dds_calibrate_uniformlize_offset:0.000000, 3.500000, -3.500000, 0.000000, 1.000000, 0.285714, 0.000000
dds_calibrate_uniformlize_amp:0x100011
dds_calibrate_uniformlize_amp:7.000000, 1.500000
**********amp_value = 0.214286,amp = 438,cal_value =1.000000
util_thread_resume:thread 0x9ec690 is resumed
util_thread_resume:thread 0x9fd0f0 is resumed
util_thread_pause:thread 0x9fd0f0 is paused
util_thread_resume:thread 0x9fd0f0 is resumed
update_trigtime:0.000000, 0.0s
anolis_picture_copy_to_data_rgb565:672 oy < dh failed.
dds_calibrate_uniformlize_offset:0x100011
dds_calibrate_uniformlize_offset:0.000000, 3.500000, -3.500000, 0.000000, 1.000000, 0.285714, 0.000000
dds_calibrate_uniformlize_amp:0x100011
dds_calibrate_uniformlize_amp:7.000000, 1.500000
**********amp_value = 0.214286,amp = 438,cal_value =1.000000
dds_calibrate_uniformlize_offset:0x100011
dds_calibrate_uniformlize_offset:0.000000, 3.500000, -3.500000, 0.000000, 1.000000, 0.285714, 0.000000
**********amp_value = 0.000000,amp = 0,cal_value =1.000000
dds_calibrate_uniformlize_offset:0x100011
dds_calibrate_uniformlize_offset:1.000000, 3.500000, -3.500000, 3.500000, 1.000000, 0.285714, 0.000000
**********amp_value = 0.000000,amp = 0,cal_value =1.000000
max =1.082851

[Muellmann]

today I was able to do more tests with a very old UHF wobble generator (1969). I was able to measure a 200MHz sinus at about 1V amplitude. This looks good but I didn't confirm with a calibrated equipment. I will come back...

[TequilaTom]

Hi W1ZZT3XX,

I bought a Hantek DSO4084B from ebay.de for 265,14€ it was shipped directly from China and arrived after 14 days.

Following your manual, I could change it to 250MHz, thx for that.

I read out the EEPROM, it contains following information:

1. 0x0007 "80M" (changed to 250M @0x0006)
2. 0x0027 "DSO4084B"
3. 0x0048 "Hantek"
4. 0x00C9 "DSO"
5. 0x014A "hantek"
6. 0x01CB "CNxxxxxxxxxxxxx" Serialnumber 13 numbers, which is equal to the calibration document of the scope.
7. 0x020C "163190" Language
8. 0x0216 "1" ?
9. 0x0227 "101.001.001.000.000.000.0"

Maybe somebody find it useful 

[danielazo69]

Hello,
 I am new to this oscilloscope and recently bought a Hantek DSO4104B.
Today, when I start it, I have the logo with all the lights on and it never starts.
I leave a photo for you to see. Can somebody help me? I think it's the damaged firmware, but I don't know how to load it.
Thank you.

[Microcheap]

The solution is simple, you need to restore the file system in scope. Try this:

Turn off the oscilloscope
Turn it on, wait about 2 seconds and turn off again.
Turn on one more time, a menu will show on the screen.
Press F2 to select the option "recover system", confirm and wait, the process takes some time.

After the restoration, update the device to its latest FW.

For more details you can check Hantek's support forum: https://www.eediscuss.com/forum.php?mod=viewthread&tid=14831&fromuid=26055

[danielazo69]

Thank you very much I just did it and it was really working. saved my life.
I have another query, now that I start, download the latest firmware from the official website, but I get an error and it doesn't let me do the update.
I leave a picture.
thanks

p/d firmware:
http://www.hantek.com/en/ProductDetail_3_12166.html

[Microcheap]

That I don't know, try sending an email to Hantek or posting a message in their forum, it can take some time but, eventually, you'll get a reply from their support.

[fer662]

Just got myself a DSO4084c as a first scope after evaluating a few alternatives. It was the cheapest I could get here (the whimsical land of Peronia) with 4 channels and decent bandwidth (and already having read about the possibility of upgrade to 250mhz) and I probably paid close to what you'd pay for a much more decent scope there (around 600 bucks). Now I'm pondering whether it's worth it to me to do the procedure, since it appears the probes that came with it (pp-90) only go up to 80mhz. Is this generally a hard limit or would I see any difference with the upgraded bandwidth of the scope with these same probes? I know I could buy better probes in the future but honestly it's probably going to be a while until I need something like that since I'm just getting started with oscilloscopes and I'm just a hobbist.

[Microcheap]

The maximum bandwidth (BW) of an oscilloscope or probe is not a "hard limit", they won't stop working after reaching this limit. In theory, the specified BW is the point where an input signal is attenuated by 3db, after this point, the amplitude of the input signal starts to fall sharply, that means, you still can see the signal, but its amplitude will be attenuated. And this is not a precise limit, normally the manufacturers leave some margin so in practice, the actual BW is greater than specified.

If you use a 80MHz probe with a 250MHz BW oscilloscope the BW of your system will be limited by your probe. I would recommend an article from Keysight which explains that better than I can: https://community.keysight.com/community/keysight-blogs/oscilloscopes/blog/2016/09/01/what-is-oscilloscope-system-bandwidth-and-how-do-i-find-the-bandwidth-of-the-scope-probe

200MHz and 300MHz probes are available relatively cheap on ebay or aliexpress but I can't attest its quality as I never used one.
Or, you can do your own high speed probe : http://paulorenato.com/index.php/93

[fer662]

Got it! I'll probably grab a higher BW probe next time i have to buy something in AliExpress and the same seller has one. I'm super happy with the scope so far!

[Simon_RL]

Microcheap, thank you very much for providing this information. Unfortunately I recently bought my DSO4204C before I found out about scope hacking.

Fortunately I did find out before I bought my HDG6082B. Got to say I am very happy with is AWG/Function Generator, it is great value. Anyway I am planning on attempting to apply the upgrade, hopefully I can get it to 200M. I am planning to read out the eprom as per Microcheaps instructions and will share all findings and results in this thread.

My only concern is a lack of backup and restore, in case of a total failure. Is anyone able to provide advice and/or assistance with the creation of the backup and restore files used for the Oscilloscope? I come from a programming background (C/C++ in Unix Environment), but am totally new to embedded systems.

[kutukvpavel]

To Simon:
The ultimate backup is a collections of images of all ROMs the device contains, made with (a) suitable programmer(s). In case anything goes wrong you reflash the ROMs and the scope is again factory-new. However, this is really inconvenient ([de]soldering) and mostly unnecessary (current firmware doesn't seem to counteract any sort of tampering). So, an average backup is just an image of the flash-rom that contains the firmware (made using UART connection to a running scope).
I don't think you should be worried that much if you are familiar with C/C++ programming (it's fairly low-level compared to .NET environment, for example, where I departed from some time ago, having to learn C/C++ and various embedded stuff simultaneously).
Check out the backup method link in the first post.

Btw, there is a longer thread on Hantek DSO5000 series hack: https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free
You may find backup how-to-s there too. Adjusting them to suit this model should be bot that hard, after all it's just a Linux distro and a flash chip that may differ.
Just in case, AFAIR, the OP is chinese-speaking guy who delivers information from chinese community here (you'd be surprised how much stuff you can find in the chinese segment if the Net, many of chinese developers of such devices actually share source codes etc). He briefly mentioned that DSO4004 series is completely different in terms of software, but if he's still around he would probably be able to help. Especially with firmware mods.

To All:
I'm about to get a DSO4084-series scope to hack it to 250MHz. Does anyone have any recent hacking experience with those? Do I still have to change a single text file only? Has anyone tested actual rise time before/after the hack? AFAIR, chinese manufacturers made some attempts to prevent hacking (at least make it more complicated) for 5000-series scopes at some point in time, therefore I'm a bit worried.

[Simon_RL]

To Simon:
The ultimate backup is a collections of images of all ROMs the device contains, made with (a) suitable programmer(s). In case anything goes wrong you reflash the ROMs and the scope is again factory-new. However, this is really inconvenient ([de]soldering) and mostly unnecessary (current firmware doesn't seem to counteract any sort of tampering). So, an average backup is just an image of the flash-rom that contains the firmware (made using UART connection to a running scope).
I don't think you should be worried that much if you are familiar with C/C++ programming (it's fairly low-level compared to .NET environment, for example, where I departed from some time ago, having to learn C/C++ and various embedded stuff simultaneously).
Check out the backup method link in the first post.

Btw, there is a longer thread on Hantek DSO5000 series hack: https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free
You may find backup how-to-s there too. Adjusting them to suit this model should be bot that hard, after all it's just a Linux distro and a flash chip that may differ.
Just in case, AFAIR, the OP is chinese-speaking guy who delivers information from chinese community here (you'd be surprised how much stuff you can find in the chinese segment if the Net, many of chinese developers of such devices actually share source codes etc). He briefly mentioned that DSO4004 series is completely different in terms of software, but if he's still around he would probably be able to help. Especially with firmware mods.

To All:
I'm about to get a DSO4084-series scope to hack it to 250MHz. Does anyone have any recent hacking experience with those? Do I still have to change a single text file only? Has anyone tested actual rise time before/after the hack? AFAIR, chinese manufacturers made some attempts to prevent hacking (at least make it more complicated) for 5000-series scopes at some point in time, therefore I'm a bit worried.

Hi kutukvpavel,
Thank you very much for taking the time to provide this information, it is very helpful. My questions were in relation to hacking the HDG6082B and creating a backup and restore for this AWG. I am still waiting for my USB to UART adapter and was my post is part of my preliminary as there is no info around on hacking the HDG6082. Although I have found a thread on hacking the HDG2XXX, I am hoping I can apply the same steps to my AWG.

[Microcheap]

I am planning to read out the eprom as per Microcheaps instructions and will share all findings and results in this thread.

I don't recall I needed reading the eeprom of the oscilloscope to be able to change it's BW, I think it was another user who tried this approach. Anyway, I don't think you need that to get the maximum bw of your function generator, if Hantek still doing things the same way, all you will need is to simple change some parameter in a text file.

To avoid any problems, just make a copy of the file before you change it (oh! and don't forget to backup the cal data as well). In the thread about the HDG2000 you can find a script (NANDDump) to copy the flash partitions of the device, you can try that with the HDG6000 and see if it works.

By the way, if you are interested, you could start a new thread for this new Hantek's HDG6000, I saw it on their web site, the specs looks good, not that I need another function generator but, I am curious to see how the firmware performs and what changes they made to the HW comparing to the HDG2000.

To All:
I'm about to get a DSO4084-series scope to hack it to 250MHz. Does anyone have any recent hacking experience with those? Do I still have to change a single text file only? Has anyone tested actual rise time before/after the hack? AFAIR, chinese manufacturers made some attempts to prevent hacking (at least make it more complicated) for 5000-series scopes at some point in time, therefore I'm a bit worried.

I don't have access to this scope anymore, but I believe it still works just fine, I don't think Hantek will ever bother to change that. Regarding the rise time, I did a quick and dirt measurement and posted it a few messages above, the change is clear.

[Simon_RL]

I am planning to read out the eprom as per Microcheaps instructions and will share all findings and results in this thread.

I don't recall I needed reading the eeprom of the oscilloscope to be able to change it's BW, I think it was another user who tried this approach. Anyway, I don't think you need that to get the maximum bw of your function generator, if Hantek still doing things the same way, all you will need is to simple change some parameter in a text file.

To avoid any problems, just make a copy of the file before you change it (oh! and don't forget to backup the cal data as well). In the thread about the HDG2000 you can find a script (NANDDump) to copy the flash partitions of the device, you can try that with the HDG6000 and see if it works.

By the way, if you are interested, you could start a new thread for this new Hantek's HDG6000, I saw it on their web site, the specs looks good, not that I need another function generator but, I am curious to see how the firmware performs and what changes they made to the HW comparing to the HDG2000.

Thanks Microcheap, no it wasn’t you that read out the eeprom it was TequilaTom. I will start a new thread for the HDG6000, I really was trying to avoid hijacking this thread and just get some pointers.

[Microcheap]

No worries, you are not hijacking the thread, your questions fits here perfectly, if you check how the others Hantek's devices are "hacked" you'll find that it's always the same approach.

I suggested a thread about the HDG6000 just because it would be easier for someone looking for more information about this awg and I'm curious, I saw this function generator on Hantek's website but I can't find anything about it elsewhere.
I already have a HDG2002 "upgraded" and I really don't need another AWG but would be nice to compare it to the new model.

[Simon_RL]

No worries, you are not hijacking the thread, your questions fits here perfectly,

I suggested a thread about the HDG6000 just because it would make easier for someone looking for more information about it and I'm just curious, I saw this function generator on Hantek's website but I can't find anything about it elsewhere.

Thanks Microcheap.

My biggest concern was lack of backup and restore. I had assumed that the backup and restore files were executable binaries and not scripts. Once I get my USB to UART adapter I will edit the scripts to suit the HDG6XXX (if editing required) and share them in a seperate thread, along with photos of the internals.

The HDG6XXX had a lot more features than I expected for the price and I am very happy with it. Although the manual while being very long is not the best and read more like marketing guff than providing instructions on how to actually use certain features.

[naumanchughtai]

Hi. New here. Don't know if this is where I should post this question. Was considering buying a 80Mhz Hantek DPO6082P scope and was wondering if this series is also hackable to the DPO6202P with 200mhz bandwidth? Or perhaps just stick with the older 200Mhz DSO 5202P model?

[Airfranz]

Hi all
I had a look to several contributions in this post and really appreciate the high quality of discussion. I am wondering if someone can help me - bought a bricked voltcraft dso-1084e with an obviously corrupted NAND and would need the full NAND content as .bin file to be able to flash over JTAG...Recovery with F2 and F3 not successful and UART serial connection shows messages that some NAND sectors are bad....
Please help 😁 thx

[Microcheap]

Have you tried to contact Hantek's support already? They will send you a recover file to restore the device.

[Airfranz]

Hi Microcheap,
Thank you for your reply! I contacted Hantek and indeed they sent me a (full?) firmware file (kernel.bin, uboot.bin, root.ubi, recover.ubi, params.bin, kernel_bk) with an uboot.exe tool to be copied on a SD card and make it bootable. This process requires windows xp (tool doesn't work on newer OS even not windows 7, I tried). That's why it took me some time to get the SD card set up properly. Then you need to put it in the SD card holder of the pcb. Bridging (shortening) two vias on the PCB causes the board to boot from the SD card and the NAND gets flashed from the SD content. The programming can be monitored on putty via the UART output. The tool gave me update success, then I removed the shortening bridge & SD card and did a reboot of the scope.
And then.....guess what 😷🤐😲💩
Nothing works anymore. Screen is blanked out, lights on the frontpanel are on, and no message / no control anymore via the serial interface. USB dead. And this although the script was running through without error.
I sent the log back to Hantek, let's see if they can help me further on this.
What I observed is that the tool obviously did not erase the NAND before programming, maybe it works only in production on a "fresh" NAND? Would not be an issue for me to replace it with a new one...
And what I learned from this - probably it would habe been better to flash root.ubi via usb and keep the uboot sector untouched, I think my scope would still show some signs of life then....
Keep you updated...
Franz

[Airfranz]

The recover process per SD boot card was successful now. Scope is operational again. Used a different slower SDHC card and bang.....After the removal of the shortening cable the scope booted from NAND as if nothing had happened. Good that I had saved a backup of the /config/cali.dat file before, because this is the original calibration data of the machine. So after the recovery I copied this file over to the machine. Self calibration went smoothly, tested and all ok now.
If you need a full recovery of the firmware this is a very easy methode. Only tradeoff is that you need a computer with Windows XP to prepare the SD card. All the required binary / ubi files, a "uboot.exe" program and a short manual how to do the update was part of a package I got from Hantek support. Contact them if you need the software, they are really helpful and respond witin a day or so!

[kutukvpavel]

Well, I finally bought one of these. And guess what, it came with a malfunctioning front panel, some of the buttons that are integrated into the encoders somehow ended up wired to keys F1-F5 (I ran the front panel test). Surprisingly, I didn't even notice it until today, even though I've used the scope a couple times after initial inspection. Has anyone had this issue before?
I don't want to disassemble my unit yet, because it's covered under warranty of a local distributor. Still, the diagnostic/repair process can get quite lengthy and if this issue comes from, say, an improperly secured flat cable or something, I might give it a shot myself.

[HHG]

Hi,

to Airfranz: please post here recovery files from Hantek.

[Siverian]

Hello community,
is it possible to change the colours of the channel to have the same sequence as LeCroy has. Voltcraft has a next one 1(Yellow) 2(Blue) 3(Cyan) 4(Green) and LeCroy has 1(Yellow) 2(Сyan) 3(Blue) 4(Green).

[Steve007iii]

I have a DSO4254B
device does not boot
and does not turn on the screen
only the LEDs on the right

Help

now if i don't know what to do
I disassembled the device and saw that all the information of the EEPROM and the operating system is stored in a Nand memory IC TSOP-48, 3V "IS34ML01G084", someone has a programmer to give me a copy of the Nand, they would be very grateful.

recovery is damaged too
https://youtu.be/W6qqxJy5auc

[boogiepopgq]

Hello, I have a NAND memory programmer and others may help you. I have a DSO4254C. I don't know if the information from there works.

[Steve007iii]

Hello, I have a NAND memory programmer and others may help you. I have a DSO4254C. I don't know if the information from there works.

oh yes this works for me i plan to restore the recovery partition if you are kind enough to upload it to download it
it is the same motherboard what changes is the software...

thanks , thanks!, thanks!, thanks!,thanks!,thanks! thank you very much.

with that information I can repair my oscilloscope!

[boogiepopgq]

Hi there!
Sorry, you know how to add languages ​​that were there before and no longer after a Recovery, is that now only German and French appear when before it had 8 languages ​​next to English, I already contacted the Hantek service but I have been doing that for days and no idea if will respond.

Thanks!

[Steve007iii]

Hi there!
Sorry, you know how to add languages ​​that were there before and no longer after a Recovery, is that now only German and French appear when before it had 8 languages ​​next to English, I already contacted the Hantek service but I have been doing that for days and no idea if will respond.

Thanks!

They take around 3 weeks to attend and the support service is not good. 

Since recovery works for you, I would recommend a force update for the uart port.

This should solve the problem 

[boogiepopgq]

Hi there!
Sorry, you know how to add languages ​​that were there before and no longer after a Recovery, is that now only German and French appear when before it had 8 languages ​​next to English, I already contacted the Hantek service but I have been doing that for days and no idea if will respond.

Thanks!

They take around 3 weeks to attend and the support service is not good. 

Since recovery works for you, I would recommend a force update for the uart port.

This should solve the problem 

Done! Hantek already answered me and they sent me a modified firmware where I recover the eight available languages and I am as before.
Thanks!

[sadeghelect]

hi
how can i active hdmi and lan port ?
thanks

[spippolone]

I have a DSO4072C I will try to update .. but I have 2 question:
the first, when you turn on the generator, default output amplitude is 2 V .. I would like to star from 0 Volt, because if I test a Final Audio amplifier without volume control I sign in with too much signal.. I must be remember to set the output before turn on the amplifier...
Some one can see if in the firmware is possible change a value to start in 0 Volt when the generator it is turn on ??

the second, has anyone tried to increase the maximum frequency of the internal generator ??

I hope to see a solution Thank you for all

[kutukvpavel]

I'm interested in the LAN port too, since keeping scope ground tied to PC ground doesn't seem like a good idea. "System settings" menu has a tab called "network", but it's grayed out.

I briefly looked with IDA into decrypted firmware upgrade packages for 4XX2C [password dso4000bc] and 4XX4C [password dso4000c]. They differ immensly: the 2-ch version is just a custom linux build, the 4-ch models utilize a custom Android build. While 2-ch version does check the system.inf for network capabilities, I wasn't able to find any code that would actually handle ethernet interface (though I didn't look too thoroughly, because I own a 4-ch one, so I focused on them primarily). Probably devices that included optional LAN interface were shipped with a modified firmware that is not publicly available. Things definitely look better for 4-ch models, I successfully identified many pieces of network code in their firmware.

The problem is, I haven't yet found how this feature is activated. The 4-ch firmware doesn't look for [net] section in system.inf, see screenshot (all fields that it gets from system.inf that I was able to identify, the ones I couldn't identify are never read, only written). The firmware simply counts the number of available devices under /proc/net/dev, and that's it, no additional checks at all. I am starting to think that no software "key" is needed, because the board physically lacks a standalone ethernet controller. This theory is supported by a boot log I found at https://sigrok.org/wiki/Hantek_DSO4004C_series/Info, it suggests that we lack DM9000 chip (or a compatible one) on our board. I'll have to check where the traces go from the transformer footprint, because I don't remember any LQFP100 footprint on the board. And an IC footprint near the transformer doesn't look familiar to me.

[McJanDK77]

Is there a guide for the terminal what i have to type in for do it to change my DSO4104C to a 250MHz ?

[McJanDK77]

Please some one Help !!!! Is this a dead forum or are people just ignoring ?

[BillyO]

Tera Term should do it.

[vladsol]

Which pins\testpoints must be shorted on the DSO4102C PCB to force sd card boot?

[mdanh2002]

A few weeks ago I hacked by Rigol DS1054Z to 100MGz, GW-INSTEK GDS1054B to 300MHz and Hantek DSO4084C to 250MHz and used a function generator to measure the 3dB point of these oscilloscopes after the hack. Long story short, after taking into account measurement inaccuracies, I considered the upgrade to 100MHz for the Rigol DS1054Z (official bandwidth: 50MHz) and to 250MHz for the Hantek DSO4084C (official bandwidth: 80MHz) has been successful. The upgrade to 300MHz for the GW-INSTEK GDS1054B is in no doubt a failure, in so far as the 3dB point is at only 100MHz, and not at 300MHz, had the upgrade been successful.

But it's quality not quantity that counts. During my tests, the Rigol DS1054Z can still display 600MHz input signals (albeit at a very low amplitude), which can't be discerned from noises on the Hantek. Measurements on the Hantek are also much less accurate compared with the other two oscilloscopes.

You can see the full write-up here http://www.toughdev.com/content/2023/03/rigol-ds1054z-gw-instek-gds1054b-and-hantek-dso4084c-digital-oscilloscopes/

[mario sanz]

Hello,
I own a kkmoon DSO4102s which obviously is a Hantek DSO4102C. The installed SW-Version is 3.50.0(181203.0) and the HW-Version is 1020xffffa000.
Unfortunately Kkmoon does not have any firmware update for this model and the support do not response at all.
Does anybody know if I can update as well using the Hantek firmware?

As the next step, I would like to make the BW upgrade but I do not find a tool for the DSO4102C to make a firmware backup.
I have seen how "Microcheap" did the upgrade with the 4072C and I have read the guideline from "W1ZZT3XX" for upgrading the DSO4xx4BC. (by the way, thank you so much for sharing)

Does anybody know if I can use the tool nandbackup_V2 for my scope?
or would the method from "W1ZZT3XX" do the job? (UNIX Shell =>"Type cp /config/root/system.inf /config/root/system.infBackup in order to create a local backup file.")

Thank you very much in advance for yor help.

Mario