Hantek - Tekway - DSO hack - get 200MHz bw for free

[tinhead]

The topic is about how to hack another one Chinese DSO (Tekway/Hantek) up to 200MHz bandwidth.


-short history

When my Tek TDS754D died some time ago i had to find a replacement. At that time (2009) I ordered few
cheap known china DSOs and tested them in detail:
- UNI-T (UT2102CE)
- Rigol (DS1102E)
- Atten (ADS1102CE)
- Tekway (DST1102B)

Finally i decided to take Tekway DST1102B instead of Rigol DS1102E because :
(ATTEN and UNI-T was at that time simply useless crap)

- 7" high quality display (Innolux AT070TN83 V1) with 800 x 480 resolution
- display viewing angle designed for "on a shelf above the workbench" use
- DPO-like functionality
- 2500 wfrms/s update rate
- Linux OS on good known Samsung ARM S3C2440 SoC
- modern firmware with lot of unique (in the <1k USD DSO price class) features

Tekway call these model "Tekway DSO 2.0 Platform", and yes, there was "DSO 1.0 Platform" in 2008-2009
http://www.tekwayins.com/product.asp?ArticleID=7
but that completely different gear (with 2.5k memory depth, 320x240 display resolution and TEK TDS2000 like firmware)

In the meantime there are as well Hantek DSOs/Handhelds using that Tekway DSO 2.0 platform, as well some rebadged
models (some made by Tekway, other by Hantek) from Extech, PCE, Voltcraft, Protek, ICEL, AKIP, Redsea, Zhongce, etc !!!


-what inside Tekway/Hantek

i have reverse-engineered the hardware and made schematics:

 -hw0 (produced from Dec 2009 to Feb 2011)    ready
  https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg56754/#msg56754
 
 -hw1005 (produced from Feb 2011 to Jun 2011)    ready errata in work
 
 -hw1007 (produced Jun 2011 to xxx 2013 , DSOs and MSOs with S/N < 15000)    ready
  https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg214613/#msg214613

 -handheld hw1001 (S/N < 15000)    in work
 
 -DSO5xxxP hw1.0    on to do list I've made alrady schematics of the new input circuit: 
  https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg264085/#msg264085


- before you hack made a backup - if you wish
 
It make sense to make backup of whole NAND flash (firmware+setting) before any hack attempt.
I have prepared easy to use "firmware update" files, simply choose your model, download the tool
and read the included Readme.txt to proceed.

For all following "B" model benchtop DSO with S/N < 15000
 - Tekway DST1062B, DST1102B, DST1202B
 - Hantek DSO5062B, DSO5102B, DSO5202B
 - Voltcraft DSO-3062C, DSO-1062D
 - Zhongce DF1202CL, DF1102CL, DF1062CL
 - Protek 3006, 3010, 3110, 3120

https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg35683/#msg35683


For all following "BM/BMV" models benchtop DSO with S/N < 15000
 - Hantek DSO5062BM, DSO5102BM, DSO5202BM
 - Hantek DSO5062BMV, DSO5102BMV, DSO5202BMV

https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg111917/


For all following "B" and "D" models benchtop MSO with S/N < 15000
 - Tekway MST1062B, MST1102B, MST1202B
 - Hantek MSO5062D, MSO5102D, MSO5202D
 - Voltcraft MSO5062B, MSO5102B

https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg185074/#msg185074


For all following "B", "BV" and "S" models handheld DSO with S/N < 15000
 - Hantek DSO1062B, DSO1102B, DSO1202B
 - Hantek DSO1062BV, DSO1102BV, DSO1202BV
 - Hantek DSO1062S, DSO1122S, DSO1152S
 - Extech MS6060, MS6100, MS6200

https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg86825/#msg86825


For all following "P" models benchtop DSO with ANY S/N
 - Hantek DSO5072P, DSO5102P, DSO5202P
 - Falcon DSO100C1G (this one http://falconindia.biz/products_desc2.aspx?id=120 )

https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg264194/#msg264194

For the cute old Tekway DST1000/DST3000/DST4000 please PM me.

For all others (not listed above) DSO/MSO/Handhelds  (e.g. with S/N > 15000) please use integrated command line tool "nanddump", do a search in thread to check how that might work.


When you need to restore previously created backup, check the Readme.txt from backup tools above and/or following links:
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg75015/#msg75015
http://www.mikrocontroller.net/articles/Tekway_MSO


- the bandwidth hack

As far i know, all DSO/MSO/Handhelds since 2009 (so yes, even the latest "P" models) can be hacked.
To hack the bandwidth all you need to do is to rename one file in DSO root directory
- when you have 60MHz/70MHz model (no matter if benchtop or handheld) you must rename /dst1062b to /dst1202b
- when you have 100MHz model (no matter if benchtop or handheld) you must rename /dst1102b to /dst1202b
- when you have 150MHz model (no matter if benchtop or handheld) you must rename /dst1152b to /dst1202b

then after second reboot (yes, you have to reboot twice) the new bandwidth (and when you decided to go
up to 200MHz bandwidth the 2ns/DIV timbase as well) will be available.

To do this you can use that tool (then simply choose what bandwidth you wish and click on "Change bandwidth")

https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg91877/

or that tool (then go to "Shell F2" tab and execute there for example  "mv /dst1062b /dst1202b")

http://peter.dreisiebner.at/dso-usb-tool/

or you can connect via UART to DSOs Linux shell and work from there. You will of course need to open the enclosure
and connect to PC via UART to USB converter (e.g. ebay CP2102 UART to USB etc). For the UART pinout check pictures below.


- optional - the bootlogo hack

you might wish to change the boot screen logo as well (not necessary for bandwidth hack).

For all following "B" model benchtop DSO with S/N < 15000
- Tekway DST1062B, DST1102B, DST1202B
- Hantek DSO5062B, DSO5102B, DSO5202B
- Voltcraft DSO1062D, DSO3062C
- Zhongce DF1202CL, DF1102CL, DF1062CL (i don't have logos from Zhongce)

Download, when missing, all the boot logos
http://www.mikrocontroller.net/attachment/136103/all_logos.zip
and copy to yor DSOs /logo directory

You will have as well to edit /logotype and /logotype.dis files. The best is to use "vi" editor on the DSO shell,
you might as well copy these two file to PC and edit there. All you need is to change the DSO name from
what it is to what you wish to see, e.g. for Hantek DSO5062B you need to change in /logotype the dst1062b to dst1202b
and in /logotype.dis the hantek_DSO5062B to hantek_DSO5202B.

If you have questions - use search, or ask in this thread.


For all other following benchtop and handheld models with S/N < 15000
- Hantek Handheld DSO1062B/BV, DSO1102B/BV, DSO1202B/BV
- Hantek Handheld DSO1062S, DSO1102S, DSO1152S
- Tekway MSO MST1062B, MST1102B, MST1202B
- Hantek MSO MSO5062D, MSO5102D, MSO5202D
- Voltcraft MSO MSO5062D, MSO5102D, MSO5202D
- Hantek DSO DSO5062BV/BMV, DSO5102BV/BMV, DSO5202BV/BMV
- Extech MS6060, MS6100, MS6200

you have to edit a specific execuatable (as the logo is compiled into it), all necessary tools are here:
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg200040/#msg200040

For all other following benchtop and handheld models with S/N > 15000 (exept "P" models, they can have ANY S/N)
- Hantek DSO5072P, DSO5102P, DSO5202P
- Hantek MSO5074F, MSO5074FG
- Tekway/Hantek MSO7000B series
- Tekway/Hantek DSO/Handheld/MSO with S/N > 15000 and hw1.0 or hw1.10 (so all with S3C2416 SoC)

All i can tell for now is that the boot logo seems to be compiled into display driver


-optional - frontend hack (models with SN < 15000)

It seem that since some time Hantek/Tekway/Voltcraft is using not that great combination of resistors in frontend, it was nearly perfect originaly but they changed it to what is today. Saving everywhere (or for reason to gie all hackers bad respons?) ^^
No matter, we can fix it easily, for more information and lot of measurment results see
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg212054/#msg212054


-optional - EEPROM licensing hack
sometimes one need or wish to enable some extra things, like LAN, more memory, video, etc. The licensing for these functions is stored in EEPROM, see here how to make use of them:
https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg467313/#msg467313


-bug list

see attached - note, this list is not up to date, i have to work on it :\[/s]


-SDK, LabView, other hardware hacks, tons of other things

simply check the post below

-Hantek's OneDrive

https://onedrive.live.com/?#cid=6C60A056648D9011



-and finally my OneDrive with hacks, firmwares, tools, etc:

my 1drive share .. PM me if does not work for you

If you like what there and wish to support me/my hacks, then feel free to donate,
there is PayPal "donate button" when you click on my "home website" icon @ my eevblog forum profile.

[tinhead]

:ALL OTHER HACKS and INFOS:

If you wish to connect to the UART, check attached pictures

all other hacks temp removed ... in last 4yrs there was so much said, hacked and released that one can easily get lost. Wht i'm doing now is to sort all that knownledge, and split into models/hw version sections. All that information will be the posten here and of course on my OneDrive (see above post for link).

[Hypernova]

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

[cybergibbons]

Thanks - that's really interesting.

As far as I know, both the GW-Instek and Rigol scopes deal with all of the display logic in the FPGA, so have quite limited ability. The UI on these scopes looks a lot more fancy.

[saturation]

Awesome job, tinman and welcome the eevblog, what a great way to start.

Don't know much about tekway, but now its worth looking in to.

[saturation]

I have a sneaking suspicion letting the hack info continue and not be suppressed is actually good for business. 

Consider:

If sales of the Rigol 1052E double, it would compensate for each single lost sale of the 1102E

But If the 1102E is really just a factory hacked 1052E, then the manufacturing cost to make either scopes is equal, so they are not losing any sales at all, just making more.  The excess inventory of 1102E can always have their case stickers changed and firmware reburned to downgrade them into 1052E.  So the only cost to make an 1102E over a 1052E is labor to do the firmware and casing decal changes.

If the owner bricks his scope and asks for factory repair, the unit is not under warranty, and now not only did they make a sale on a scope, they can charge for repair

Rigol now has a bigger reputation, free publicity, more people own it, know its electronics intimately and thus have a better appreciation of its capabilities, and will consider buying their other products now too

So, its a win win.

If you look at the trends in electronics, there is a market of makers and hackers so manufacturers are addressing their wants.  Hakko's new iron, the FX888, Agilent's DMM skins, Hakko 936 skins etc., certainly isn't directed towards professional electronics.







Which prompted Fluke to make this ad:

http://register.fluke.com/globalforms/goyellow/index.html

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

[Hypernova]

I have a sneaking suspicion letting the hack info continue and not be suppressed is actually good for business. 

Consider:

If sales of the Rigol 1052E double, it would compensate for each single lost sale of the 1102E

But If the 1102E is really just a factory hacked 1052E, then the manufacturing cost to make either scopes is equal, so they are not losing any sales at all, just making more.  The excess inventory of 1102E can always have their case stickers changed and firmware reburned to downgrade them into 1052E.  So the only cost to make an 1102E over a 1052E is labor to do the firmware and casing decal changes.

If the owner bricks his scope and asks for factory repair, the unit is not under warranty, and now not only did they make a sale on a scope, they can charge for repair

Rigol now has a bigger reputation, free publicity, more people own it, know its electronics intimately and thus have a better appreciation of its capabilities, and will consider buying their other products now too

So, its a win win.

If you look at the trends in electronics, there is a market of makers and hackers so manufacturers are addressing their wants.  Hakko's new iron, the FX888, Agilent's DMM skins, Hakko 936 skins etc., certainly isn't directed towards professional electronics.

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

Well, that certainly reminds me of the conspiracy theory that Microsoft was loose on copy protection in the early years to ensure that they get the market share in first.

[PsI-On]

Hi tinman,

Can you post some more pictures please?

Looks like I'll be picking one of these up in China next month ;o)

Thanks.

[Mechatrommer]

cant find it in ebay, just the 200MHz version. maybe they are pulling all 100MHz back to upgrade to 2.04.SP1 FW? just speculation, not related to anyone who is still live or dead.

[PsI-On]

They're listed on www.taobao.com

Be warned, checking prices on taobao.com will leave you feeling sick every time!

-P

[tinhead]

cant find it in ebay, just the 200MHz version. maybe they are pulling all 100MHz back to upgrade to 2.04.SP1 FW? just speculation, not related to anyone who is still live or dead.

a month ago electrolab.com had some 100MHz versions. It can have something to do with the rumoured Hantek/Tekway deal,
but it can be just whatever. The distributor in Germany have still enough in stock, and of course taobao is full of sellers anyway.

Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

Well, there are many competitors on low cost DSO market. That why probably every company have to reduce the costs.
You can hack almost all low cost DSOs, the question for me was only "which SOC/µC inside, which OS".

With Samsung S3C2440 and Linux 2.6.13 was easy thing, much easier than with TI DSP or pure FPGA based DSOs.

[tinhead]

maybe they are pulling all 100MHz back to upgrade to 2.04.SP1 FW?

i don't think that they will every try. By design the DSO is using these few config files, as this is Linux these can be always changed.
Of course Tekway/Hantek can try to disable UART port, JTAG can't be disabled. But even if, you will be still able to make backup
of the firmware via JTAG, to "patch" it on your mini2440 board and to restore it back to DSO.

The only chance is to change the PCB (the low pass filter around AD8370), which costs more money.
EDIT: Actually there are some differences between model,  however a hacked 60Mhz DSO can be still good up to 180MHz (-3db)
which is i think good value.

[slburris]

Any idea if Tekway makes Hantek's handheld oscilloscopes too?

Do you know if the Hantek DSO-1060 could be modified to be
a DSO-1200?  This would change a 60Mhz scope into a 200Mhz scope.

Great information, I bet there's going to be tons of discussion
about this topic!

Scott

[tinhead]

Hi tinman,

Can you post some more pictures please?

Looks like I'll be picking one of these up in China next month ;o)

Thanks.

sure, some PCB pics attached. As you can see the PCB is very nice routed, these guys did good job

For the outside pics check the tekway/hantek websites.

Btw, the DSO is fanless, which is good.

[tinhead]

Any idea if Tekway makes Hantek's handheld oscilloscopes too?

Do you know if the Hantek DSO-1060 could be modified to be
a DSO-1200?  This would change a 60Mhz scope into a 200Mhz scope.

Great information, I bet there's going to be tons of discussion
about this topic!

Scott

the other Hantek DSOs are made by Hantek itself (or others), but definitely not by Tekway.

Tekway started to made DSOs 3years ago and they never had handheld based devices.

[slburris]

I've posted a pointer to this thread over at RCGroups site.

Scott

[Mechatrommer]

whats with the blank capacitor? top left near the samsung? 4th picture

[PsI-On]

Looks like it's probably some sort of sounder, I can see what might be a transistor drive circuit feeding off the negative pin!

Maybe battery backup?!

[tinhead]

whats with the blank capacitor? top left near the samsung? 4th picture

That's where the buzzer was soldered. During debuging the uncofigured Samsung SOC was making me crazy
(driving the buzzer high), so i removed it.

[PsI-On]

I wonder if you can redirect the terminal session to the 7" LCD and use a USB keyboard (that would make an awesome hackable scope)

[tinhead]

I wonder if you can redirect the terminal session to the 7" LCD and use a USB keyboard (that would make an awesome hackable scope)

The DSO is like a friendlyarm 2440 board, with FPGA and ADC connected via I/O.
Afaik you will have to recompile the 2.6.13 kernel to redirect terminal session to the TFT.

So in principle yes, with recompiled kernel you can redirect the terminal to TFT, use a usb keyboard
(or on screen like xvkbd with touch screen if you connect one) and if you need the DSO functionality
you have only to start the DSO app from the shell (/dso.exe). Of course the /dso.exe line in rcS
need to be commented out.

[tinhead]

attached fast rise time 10MHz (1ns rise time) test signal measurement.

It is not really perfect example just because the 50Ohm termination
and cable loss, but already 1.8ns which give you an idea what's possible.

[PsI-On]

Tinman, have you tried this hack on the DST1062B?

Do you know if the DST1062B has the same components as the DST1102B?

Thanks.

[ngkee22]

I did find this one for sale, but it is already at 200Mhz.

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=270568563296&ssPageName=STRK:MEWAX:IT

[tinhead]

I did find this one for sale, but it is already at 200Mhz.

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=270568563296&ssPageName=STRK:MEWAX:IT

yes, right now "Electrolab" have only 200MHz, but they had 100MHz during last months, e.g.

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=270603792546

However they never had 60Mhz versions, maybe just question of profit ?
They known Measurements Equipment provider, just ask them for 60Mhz.


Probably the same (pprofit question) is for "GoodluckSell"

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=280552591608

If you compare the price on ebay on taobao.com you will see that a 60Mhz Tekway/Hantek should costs about 400-450$.