Hantek - Tekway - DSO hack - get 200MHz bw for free

[NCG]

 The kernel check (for 2.6.30.4) seems to be only cosmetic in nature for the 2Mpoint depth (appears to work with checks removed, with 120224.0). Also it seems unnecessary at first glance, that capture depth 1M/2M check is executed with changing timebase...

 Can the debugmode be entered, something interesting there?

A 1Mpoint DSO will not mutate to 2Mpoint model only if you change license informations
in EEPROM - a physical chip will be necessary .. and few other things like e.g. kernel 2.6.30.4 (yeah, the firmware will
check this and if you don't on 2.6.30.4 the 2Mpoint will be not enabled even if you have license).

[tinhead]

The kernel check (for 2.6.30.4) seems to be only cosmetic in nature for the 2Mpoint depth (appears to work with checks removed, with 120224.0). Also it seems unnecessary at first glance, that capture depth 1M/2M check is executed with changing timebase...

Can the debugmode be entered, something interesting there?

Sure, it can be removed. You need to check in few places as the firmware is checking also while accessing
device drivers (still in dso.exe), just look for "26304" string in disassembly.
Btw, did i mentioned already that exports are removed from current firmware? It make sense to leave copy of
2.06.3_120224.0 somewhere to have a chance to compare code from older (with exports) and current (w/o exports) versions.
Not that this is really necessary, but it makes quick checks easier.

regards debug mode, haven't tried anymore since a long time as it was nothing special there.

[carloscuev]

Sure, it can be removed. You need to check in few places as the firmware is checking also while accessing
device drivers (still in dso.exe), just look for "26304" string in disassembly.
Btw, did i mentioned already that exports are removed from current firmware? It make sense to leave copy of
2.06.3_120224.0 somewhere to have a chance to compare code from older (with exports) and current (w/o exports) versions.
Not that this is really necessary, but it makes quick checks easier.

regards debug mode, haven't tried anymore since a long time as it was nothing special there.

So this means that original "B" model users could save up to 2Mpoint?
What do you call exports? I've just saved a CSV to USB stick using 120430 firmware, so I guess exports are another thing.

[tinhead]

So this means that original "B" model users could save up to 2Mpoint?

depends on few things, in priciple this are things what a "B" need to have to run as "BMV":
- kernel must be 2.6.30.4 (or fw each time patched to skip that part or dummy "uname" need to be created
  to alway answer with 2.6.30.4 when aksing via uname -r.)

- matching device drivers (meanign for kernel 2.6.30.4) or the fw need again to be patched eacht itme you
  do an update to load old drivers instead new drivers (when runnign 2.6.13 kernel and lying about kernel version)

- eventually proper FPGA design

- eventually proper CPLD design programmed into CPLD

- depends on PCB version maybe two selfmade traces or existing ones.

and of course the bigger physical SRAM chip.

Looks complex? No, it's not. Kernel and device drivers are since the published GPL code not an issue anymore
(so no need to wait for physical dump from someones BMV model). FPGA and CPLD designs are still what we
eventually looking for. I do have working FPGA and CPLD designs to support 2Mpoint, but they from
handhelds - in principle they runs on bench models too, but two SRAM traces need to be selfmade (even of hw1007 where
even 4Mpoint is already routed between CPLD, FPGA and SRAM). I do have all i need to run a test,
but no time for that (as i would need to solder all components from that board which i'm using to double check the
hw1007 schematics ...) so you see just too many tasks i'm working on.

Maybe someone can try to solder bigger SRAM  - IS61LPS51236A-200TQLI(digikey 706-1100-ND ),
to patch fw (or install 2.6.30.4 kernel or patch uname) and to report back if the hw1007 boards and
their CPLD design are already good enought for 2Mpoint. I remember Tekway told me this once (actually even 4Mpoint),
but i never tested this on bench since i was wating for final "BMV" model where 2Mpoint works for sure.

What do you call exports? I've just saved a CSV to USB stick using 120430 firmware, so I guess exports are another thing.

the firmware internal procedure names, when you do disassembly they usefull to recognize (immediately by name)
what the firmware is doing in a specific procedure. So they not for every day use important but for advanced hacking.

[carloscuev]

Oh thanks for explaining, unfortunately my Tekway scope is my top notch test equipment and would be left hopelss if I manage to break it by changing the SRAM. I see that the recommended SRAM is 18 Mbit, what resolution is the ADC? (10, 12? I guess there's room for a little more points, or is some extra bits of metadata are needed? ) Why not replacing with a bigger SRAM, maybe in the future it's possible to save 4 Mpoint !!

[NCG]

 I did change the chip on bench model. There is some weirdness with different timebases going on, based on dropping waveform update rate and points available going from 1M to 2M it does have 2M. There are obvious glitches (missing some part of capture on 1kHz squarewave etc) on some timebases. I have to yet determine, if it is caused by just inadequate 2M check removal, is it intentional to disable 2M for some timebases (because of some bugs) or there is something more serious like addressing for sram. Address pin 80 seems to be disconnected...

Looks complex? No, it's not. Kernel and device drivers are since the published GPL code not an issue anymore
(so no need to wait for physical dump from someones BMV model). FPGA and CPLD designs are still what we
eventually looking for. I do have working FPGA and CPLD designs to support 2Mpoint, but they from
handhelds - in principle they runs on bench models too, but two SRAM traces need to be selfmade (even of hw1007 where
even 4Mpoint is already routed between CPLD, FPGA and SRAM). I do have all i need to run a test,
but no time for that (as i would need to solder all components from that board which i'm using to double check the
hw1007 schematics ...) so you see just too many tasks i'm working on.

Maybe someone can try to solder bigger SRAM  - IS61LPS51236A-200TQLI(digikey 706-1100-ND ),
to patch fw (or install 2.6.30.4 kernel or patch uname) and to report back if the hw1007 boards and
their CPLD design are already good enought for 2Mpoint.

[tinhead]

pin 80 is unused, this is actually (parity) data pin. These SRAMs are 36bit wide, DSO is using only 32bit therefore 4 data pins are not connected.

To see the difference between Hantek Handheld (where i do have working 2M CPLD/FPGA combination available), the hw0 model
from which i posted schematics here some time ago (in that model there are no traces between the addres pins and CPLD to support
2 or 4M - they need to be done manually) and the hw1007 bench model (on which SRAM is already routed to CPLD to support even 4M,
but of course firmware can't do this now - note the difference to handheld on SRA18 pin) i did prepared 3 snapshots of the
schematics from each of these models. That's the important things only - CPLD and SRAM sheets, so you can compare and see
how things has been made.


EDIT: and no, please don't ask me for the rest of the schmatics .. when i'm done i will post it ...

[tinhead]

Following GPL inks are for models with s/n below 15000


it seems the Hanteks webmaster was a bit stoned

On product pages there are downlaod links to /down/ or /gpl/ subdirs (talking now about GPL code) but they broken.
Anyway, when you look for GPL sources you will find them here:

For Hantek DSO5xxxB, and Voltcraft DSO3062C models:
http://www.hantek.com/download/desktop.zip

For Tekway DST1xxxB, DST4xxxB, DST3xxxB models (Tekway posted this link on their website, the directory
contains GPL code and new firmware versions for Tekway DSOs):
http://www.eedownload.com:2108/

Both desktop.zip files from above are equal, so you don't need to download both, however there is another one
newer version available (it contains root_fs and some missing libs)
http://www.eedownload.com:8888/desktop.zip


For Hantek Handheld DSO1xxxB/BV models:
http://www.hantek.com/download/handscope.zip
or
http://www.eedownload.com:8888/handscope.zip


For Hantek DSO5xxxBM/BMV models:
http://www.hantek.com/download/desktop_video.zip
or
http://www.eedownload.com:8888/desktop_video.zip


For Tekway MST1xxx models:
http://www.hantek.com/download/desktop_logic.zip
or
http://www.eedownload.com:8888/desktop_logic.zip


All these files got updates few days ago, they contains now additionaly root_fs.
It seems however that something goes wrong, desktop.zip contains kernel 2.6.13 but root_fs for 2.6.30.4,
and desktop_logic.zip kernel 2.6.30 but root_fs 2.6.13 ... maybe a good ide to download them all (1.5G only) ...
oh and of course don't forget to download :

http://ftp.gpl-devices.org/pub/vendors/Voltcraft/VOLTCRAFT_dso3000series.zip

as it contains tool sources already removed from newer files (but still in use on current models)

There is additionaly only the root_fs for Voltcraft models (or wll, all 2.6.13 kernel based model)
and copy of the qq2440 DVD here:
http://www.eedownload.com:7635/


Having all these root_fs, kernel and driver versions you can build by yourself a "like a BM/BMV model".

[gilsoriano]

Hi guys,

first of all, thanks a lot to tinhead for such an impressive tear down of Hantek's DSO oscilloscope. I was able to serially connect to telnet and everything went fine.

Now, I was thinking in adding extra features and it would be nice if we can organize ourselves to boost it up. For me, the two more important things to add to the oscilloscope are:
* Logic analyzer capability: let's start with I2C, SPI...
* Telnet over ethernet: I would prefer connecting via LAN instead of serial connection.

I don't know if we have already a logic analyzer project, but it would be really nice having one. I see that we can do it in two ways:
* Parsing the serial data to the computer (I doubt about the performance of this). Needs an application to be running in the computer.
* Code a built-in LA in the oscilloscope (don't know where to start with this).

Then, telnet over ethernet. I've heard that there's something built-in for the ethernet capability, but no idea at all. The second obvious option is to get a serial-over ethernet adapter and put it into the DSO. This second one will be more expensive and slow.

Sorry if it seems too dumb what I'm writing. Hope we gather some forces!

Cheers,
Carlos

[Bored@Work]

Now, I was thinking in adding extra features and it would be nice if we can organize ourselves to boost it up.

dso.exe is the application that hogs the display, the keys and all the hardware. To add more features you either have to inject code into dso.exe or replace dso.exe with something else.

Injecting code into dso.exe requires some trickery. With Hantek removing the exporting of a lot of symbols in the latest firmware this has become more tricky. Replacing dso.exe with something else would require to rewrite all oscilloscope functions from scratch. The alternative to start with the disassembled dso.exe and adding own functions, would violate Hantek's copyright.

Looking at the amount of boring work to do one of the above, compared to what can be gained, I doubt it makes much sense to do it.

* Logic analyzer capability: let's start with I2C, SPI...

The junk PC software shows an alternative way. Read the captured date from the DSO to a PC and decode it with some PC application. While Hantek's PC software is junk it should be easier to write an own PC software doing the decoding than hacking the DSO software.

I would prefer connecting via LAN instead of serial connection.

IIRC there are at least two ways described in this thread. Adding the missing Ethernet hardware to the DSO PCB, or adding the missing drivers for an USB-Ethernet adapter and using a USB-Ethernet adapter.

[tinhead]

Firmware Backup Tool for Hantek  DSO5xxx BM / BMV models ONLY

- download the attached file and unzip the dst1kb_bm_bmv_backup_tool.up (MD5 c1e5a47f7fa4d0f28b53dbb84d2598c4)
- copy the dst1kb_bm_bmv_backup_tool.up to usb flash drive, ensure nothing else on that drive
- insert usb flash drive into front usb port of your DSO
- run firmware update (Utility, Page 1/2, F2 and F6 to confirm)
- watch usb flash drive LED blinking for few minutes ...

After the backup tool is read (it will take few minutes) your DSO should reboot automatically, if not you will have to do it manually
Now you can remove flash drive and save the content in a secure location.

You will find on the use flash drive directoy "dump" and 4 files (yes, 4 not 3 like on benchtop "B" models)

boot.bin
kernel.bin
root.bin
root2.bin

The first 3 files are already known, the roo2.bin is actually boot logo. I do not have (yet) restore procdure
for this backup, i will for sure develop one as soon i get such backup. So when you have BM/BMV model and
wish help me and others, use that tool, pack these 4 files with winace/winrar/zip/gz/your fav tool, upload in
a secret place and PM me the link

[colinbeeforth]

G'day,

Well, I was visiting the Hantek website recently and saw the latest software release for my DSO5102B:  'dst1kb_2.06.3_15102b_fact(120423.0).up'

I installed it.  Now the scope is utterly useless and unstrustworthy.

Simple input triangle wveform 1kHz.  Displayed ok.  Then shift the timebase up or down a few steps, and the waveform disappears.  Other function don't work properly - it's nearly useless and I can't trust that it's showing me what is actually there.

I tried running the previous upgrade,  'dst1kb_2.06.3_15102b_fact(120224.0).up'

However, it does not fix it.  I suspect because the upgrade process is only incremental, reverting to an earlier upgrade can't fix it.

Anyone got suggestions how I have revert to the earlier software, or how to do a full install and upgrade to a less horrible version that the current one?

Frankly, I'm fed up with Hantek.  I've had this scope one year now.  I've made 'new product' excuses for Hantek a number of times, hoping they would improve their software and support.  After one year, their new software upgrade wrecks the scope.  They seem to have learned nothing.  Their software engineering is shameful.  They could do far worse than open their software to a community, but since that seems to be impossible for their cultural outlook, I can only hope I can return the scope to something like normal operation - then I can sell the useless object!  the galling thing, is the hardware has potential, it only needs some decent software.  Talk about frustrating from an end user viewpoint...

If I spend 3 times as much as the Hantek, I can get an Agilent scope.  It will be far more than 3 times as useful since it will at least work most of the time.  Even if I just keep my old LeCroy 9310M running, the usefulness in return for cost equation is hugely better.  The DSO5102B might be low cost, but it is so poor in reliability and usefullness that I don't want it any more.  I've got work to do, I can't waste any more time on a tool that I can't trust to show me a true waveform.

So, can anyone help me restore an earlier software setup, so I can get it working again so I can sell it?  I've had enough of Hantek and their terrible software and dismal support.  The hardware seems ok, and could work if they had any software engineering capability.  Have they no pride in their product?

Colin

[tinhead]

However, it does not fix it.  I suspect because the upgrade process is only incremental, reverting to an earlier upgrade can't fix it.

right, you need to special crafted firmware to be able to downgrade.
However, when you have older version you can decrypt the *.up file, and copy manually the dso.exe and /Ourlanguages content over to your DSO. You can you the usb tool (check first page of this thread)

Did you remember what firmware version was installed before? I do have almost all fw versions here, so i can
decrypt/extract the dso.exe or compile update file for you.

Anyone got suggestions how I have revert to the earlier software, or how to do a full install and upgrade to a less horrible version that the current one?

Frankly, I'm fed up with Hantek.  I've had this scope one year now.  I've made 'new product' excuses for Hantek a number of times, hoping they would improve their software and support.  After one year, their new software upgrade wrecks the scope.  They seem to have learned nothing. 

they stopped to publish any updates for now, i will tell you later today why and what's about.

[LEECH666]

My Voltcraft DSO-3062 just died too. Locks up after start. Can't acess anything. Scope doesn't react at all. What a huge pile of crap.

Is there an easy way to fix this?

Florian

//EDIT:

Stuck in this mode (see attached picture). No idea why. Just died on it's own.

[tinhead]

Is there an easy way to fix this?

well, did you installed my fix or at least the latest firmware? For me it looks like the profile bug, you will have to delete (connect over UART to DSO) the file /param/sav/run*

[tinhead]

There are some news about the firmware development and bug fix status, but let me start with somethign else.

During last weeks i was trying to sign co-operation contract with Hantek. The idea was to help them out, to fix firmware
issues (FPGA and ARM). There was an additional benefit for them -> due the NDA i would have to stop publishing and
supporting any hacks.

Unfortunately Hantek tried to cheat on me (actually twice), so i was finally pissed off and "overreacted" a bit , since them
there is no communication at all between us. My company (and I) have enough open projects for next 2yrs, so not a big deal
at all.  For Hantek no idea, in principle there are many skilled engineers in China, all they need to do is to ask someone for help.

Sure, they told me (and that was the last statement) "because of the long issue list our engineer will re-develop the complette
firmware, we will do QC on that and then made it availabe to our customers. This will take two months", but knowing that
since more than a year they still not managed to remove few bugs i honestly don't know what to think about.
Yes i know, they added many new features and yes i know all these bugs are not really something you can't fix
- but their QC, gosh, it is just ridiculous! I tried to protect them more than once, but honestly guys if i could turn back the time
i would warn Tekway. At time of my first posting i was more then satisfied with my Tekway DSO, but looking back on what
Hantek did to this DSO platform i'm really disappointed.

However, let's hope the best - soon we will see the results.
EDIT: i've just got nice email from Hantek, the firmware will be revised not re-developed.
This of course change the whole situation and make sense, two months to re-develop
would be a typical chinese killer, but two months to revise the firmware is perfectly acceptable

I assume Hantek will not publish any firmware updates until they ready (but who knows ...), so i decided to publish actuall bug
list to share with you all the status quo. There is also workaround list inside. All these bugs are as well on B and BM/BMV bench
top models.

When you read the pdf file, you will find some information about firmware 2.06.3_(120507.6). This is just modified version
of firmware 2.06.3_(120507.0) which you can find (unmodified) in the roof_fs dump (yaffs_2.6.13.bin) attached in this file

http://www.eedownload.com:7635/bootloader.zip

All i did was to patch out 3 bugs (this part works already with no issues), however i will try to patch 3 other
bugs (20, 22 and 24) before i post it here. In case i fail, i will of course post the latest working version.
Just give me a day or two.

EDIT: Attachement removed, check first post in this thread

[digsys]

All i did was to patch out 3 bugs (this part works already with no issues), however i will try to patch 3 other
bugs (20, 22 and 24) before i post it here. In case i fail, i will of course post the latest working version.
Just give me a day or two

Bummer, that was one of the make / models I am trying to decide on, but I have to have reasonable reliability.
I, and I'm sure others, appreciate the the work you've done on this, and your patience with the manufacturers.
I've worked with chinese firms on many occasions, and it's often so frustrating, I just give up.
Rarely had ANY trouble with the Taiwanese when they were starting up, they had a totally different attitude.

[LEECH666]

hi,
what can i do if i have this problem ? whithout installing this patch before ?
i have last firmware.

thanks.
marc

unfortunately you will have to connect via UART to the DSO (3.3V TTL UART converter is what you need)
and delete manualy the affected file, just execute on the shell rm -f /param/sav/run1kb*
or send the unit back to the shop where you bought it originaly.

I assume this is what I have to do. I've got an iTeaduino v1.1 (Ardunio clone) which has a FT232RL chip on it, I asume I could talk to this chip over Putty / Hyperterminal. Will have to test it out later ...

[tinhead]

Another reason why I would not believe in the rewritten software. The current codebase has a few years of QC, done by the customers. The fresh one, hacked together in two month, will not have any OC worth to mention.

luckily they not such "crazy" as i thought, see my edited posting above.

[Bored@Work]

EDIT: i've just got nice email from Hantek, the firmware will be revised not re-developed.This of course change the whole situation and make sense,

You think so? When was the last time Hantek told the truth? For whatever reason they need two more month. The least likely reason is they really want to fix the problems. Maybe they just wanted to get you off their back for two month.

two months to re-develop
would be a typical chinese killer, but two months to revise the firmware is perfectly acceptable

With their programmers and QC? They had a lot of month to fix things in the past, but didn't manage. If they don't change the way they develop these two more month won't help much.

[LEECH666]

hi,
what can i do if i have this problem ? whithout installing this patch before ?
i have last firmware.

thanks.
marc

unfortunately you will have to connect via UART to the DSO (3.3V TTL UART converter is what you need)
and delete manualy the affected file, just execute on the shell rm -f /param/sav/run1kb*
or send the unit back to the shop where you bought it originaly.

I assume this is what I have to do. I've got an iTeaduino v1.1 (Ardunio clone) which has a FT232RL chip on it, I asume I could talk to this chip over Putty / Hyperterminal. Will have to test it out later ...

Okay that worked out quite nicely.

I also took notes on what I did, in case anyone else needs a step by step unbricking guide.

Florian

[jack163]

Hi,

I am really impressed about the work of tinhead and others about Hantek "upgrades".
Recently I purchased a handheld DSO1102B.
After checking the PCB I have some questions:

It seems that the RJ45 socket connects not only to LAN but also to some kind of RS232 interface.
Do you have information how to populate/activate the RS232 option?
---> Edit/Add:
 Hoppla, just saw some information about RJ45 UART in #1029.
Did you try this option in the meantime?
---

For SD card option: Is it sufficient just to populate the card holder or are some additional resistors etc. necessary?

Then I saw near to the UART connector an empty connector named "WLAN" Do you have information about this option?

Thanks in advance

jack163

[tinhead]

Hi,

I am really impressed about the work of tinhead and others about Hantek "upgrades".
Recently I purchased a handheld DSO1102B.
After checking the PCB I have some questions:

It seems that the RJ45 socket connects not only to LAN but also to some kind of RS232 interface.
Do you have information how to populate/activate the RS232 option?

---> Edit/Add:
 Hoppla, just saw some information about RJ45 UART in #1029.
Did you try this option in the meantime?
---

no, only tested on bench top models (and draw small schematics)

https://www.eevblog.com/forum/general-chat/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg95759/#msg95759

Note that on Handheld the RJ45/uart multiport pinout is bit different (actually better than on bench top)

For SD card option: Is it sufficient just to populate the card holder or are some additional resistors etc. necessary?

you only card holder (and the SD card licensing in EEPROM, search this thread for details)

Then I saw near to the UART connector an empty connector named "WLAN" Do you have information about this option?

no, not yet, probably it is sharing USB pins ? you will have to check that, i'm bit overloaded with other things now.

[Polossatik]

I'm checking for a scope for friend and see that the Voltcraft 500MSs 60MHz DSO3062C  is back in stock. http://www.conrad.de/ce/de/product/122464
anyone who knows if this is still the 1GSs 100MHz version?

[tinhead]

anyone who knows if this is still the 1GSs 100MHz version?

as there are only GPL sources for ONE model available i assume this is still the same 1GSs hardware.