Hantek - Tekway - DSO hack - get 200MHz bw for free

[tinhead]

Tinman, have you tried this hack on the DST1062B?

Do you know if the DST1062B has the same components as the DST1102B?

Thanks.

Afaik yes, EDIT: check the later in this thread published schematic

[tinhead]

from Rigol thread ...

that's the self-calibration unit, it runs with 125Mhz.
 

Do you mean that it has a 125Meg oscillator on board which is used for the sole purpose of selfcalibration???

I'm replying here just because this have nothing to do with Rigol:

Tekway is using 100MHz XO, however due only 4 ADCs in last 3 highest timebase ranges the FPGA PLL output is set to 125MHz.
Exact the same clock is used for normative-actual value comparison, there are some presets (files) in the firmware for pulse, edge and overtime compare.

[tinhead]

another user in forum recieved Hantek DSO, he reported already that the jtAG pin header is not soldered, so you will have to solder 20pin 2mm header or just to use attached firmware update which will do firmweare backup to USB stick for you.

How to use :

1. unzip the attached fw2dump.zip. You will find 3 files (dst1kb_9.99.9_cli(111111.0).up, nanddump and asgard)
2. unplug any USB cables from your DSO first!
3. copy dst1kb_9.99.9_cli(111111.0).up to usb stick (delete all other files from stick!), put into DSO and execute the firmware updated.
4. after update switch off DSO and unplug the stick, switch on the DSO back. The firmware version will be not changed, but thats ok
5. copy the "nanddump" and "asgard" to usb stick (delete everything else from the stick!), plug into DSO and wait 10-15 sec.
6. plug the DSO via USB to your PC. If the LED on your stick didn't started to blink, unplug the USB cable and plug it again after
   additional 15 seconds (this is because how the usb agent is working on the DSO)
7. the LED on usb stick will start now to blink, the DSO is dumping itself to the usb stick. This can take up to 5 minutes, so just be patient.
   Sometimes the usb agent on DSO is a bit slow/srtange acting, so watch your LED - if not blinking retry just and wait few secs more between step 6 and 8
8. After the 5 mins unplug the stick first, then the usb cable (or the selfdump will start again)


On the usb stck the "asgard" file has been now renamed to "asgard.done", this is just protection to now execute it over and over again.
You will find 3 additional files :
boot.bin (thats the vivi bootloader)
kernel.bin (the kernel)
root.bin (root FS)

All dumps are done with NAND OOB blocks, so we can restore them any time later if we need to original version.

This step can be executed on all devices, Hantek/Tekway or Protek, it is modifying only usg.agent and works even with older Tekway DSOs (A series which have kernel 2.4), so we good for a while. it is kernel 2.4 and 2.6 compatible, and it will not break linux itself.

for Tekway/Hantek DSO user:
you can use the asgard script to whatever you like, the DSO will now enumerate for attached usb ticks, if any present for file named asgard on it, if present it will execute the asgard scipt. Of course be careful with copying/moving things.

for Hantek DSO users:if you have such dump, zip/rar it and post it here, so i can then prepare a hacked firmware updated to allow you to "update" your DSO to 200MHz without UART/terminal/JTAG, like for Tekway DSOs.


General note:
if one of my updates is stopping to work, with firmware update error then you can be sure nothing broken on your scope.
Then probably Tekway or Hantek did changed the gpg magic and we have dump firmware over JTAG to find the magic again.

if during the hack the DSO is reporting that the firmware is older than installed or didn't worked, then let me know your firmware version number - then i will have to increase the number too.

EDIT: I updated this firmware-selfdump hack to version 9.99.9 making it firmware versiond indenepndant (works with all known Tekway/Hantek firmware versions now)


updated, go to here:
https://www.eevblog.com/forum/index.php?topic=1571.msg35683#msg35683

[tinhead]

here we go ... again

i got Hantek firmware dump from another user here in forum (thx G***!) and installed on my Tekway DSO, it is booting without any issues.

With this firmware i was able to prepare a hack which will switch your Hantek DSO5062B or DSO5102B to DSO5202B
- so again we have 200MHz bw for free - this time for Hantek DSO's

All you need to do is to copy the attached dst1kb_2.06.9_cli(101031.0).up to USB stick and run a firmware update on your Hantek DSO.

If you have higher version of firmware on your Hantek DSO already, please make a firmware dump with JTAG or with:

https://www.eevblog.com/forum/index.php?topic=1571.msg23807#msg23807

and post it here or send me a message

Check here (generic hack for all versions):
https://www.eevblog.com/forum/index.php?topic=1571.msg24564#msg24564


There is only one thing missing, Hantek didn't included boot logos for all models, so you DSO will still shows up during boot your old model name, but who really cares about boot logo.

The System Status shows up right version, the TTScope is displaying 200MHz model and of course we have 200MHz bw and 2ns time base.

Some technical things:

Hantek have newer verion of firmware as Tekway so few things changed, if you wish to play with JTAG/UART way of hacking you will have
(additionally to all those steps described in my first post) to edit another one file in root directory (logotype.dis).
You will need to edit it and change whatever you see there to "hantek_DSO5202B". If you don't do it the the bootlogo will
be not loaded, but your DSO will still boot-up.

What's new in Hantek firmware 2.06.2 (compared to Tekway 2.05.xx)
- French/German/Chinese/English/Japanese menu language supported instead of only Chinese/English
- CSV export to USB (up to 40k samples only, but better than nothinig)
- a bit better export menu (much easier to recognize what your saving)
- more colors for menu/submenu/background (black/green/pink/yellow/blue instead of only blue)
- trigger works now stable up to 300MHz (of course after hacked to 200MHz bw)

What Hantek made worse than Tekway:
- TTScope virtual panel is crippled, the developer who did changed the virtual TFT size was probably blind or not aware that
   this DSO have wide-screen TFT ... anyway, i did changed the affected EnglishResource.dll, so just unzip the attached
   into your TTScope\Language directory (overwrite the org. file)


For Tekway DSO users:
i will publish in the next days an 2.06.2 firmware update for Tekway DSOs, this update will change your Tekway DSO to Hantek DSO,
so you will be able to use the new features too. Most files seems to be same, but i need to compare and debug them a bit before i post anything.

check here :
https://www.eevblog.com/forum/index.php?topic=1571.msg24564#msg24564

Wondering if Hantek will ever publish the firmware source code, it is GPL licensed so normaly they should do it.
It would be easier to compile own hacks. my current dev environment is a mix of some Samsung S3C2440 boards, no easy to match memory mappings
and other things to compile for example WiFi modules (i think would be nice to be able to save CSV/waveforms/snapshots over WLAN)

.

[g***!]

Hello there, great article....I got a bit of a buzz when I switched my computer on and saw my firmware running on your Tekway!
I did notice that TT Scope's driver does not want to party with windows 7!
I have not tried the downlosd yet....but will do very shortly....I wonder will this cause a surge in Tekway/Hantek sales. 
It certainly appears a much safer mod to do than the Rigol one!  I will post the photos of the internals later, need to tidy them a bit first....now i'm off to install some firmware!

[g***!]

Yes tinhead, there is now a 200Mhz DSO5102B!  I will let the scope warm up for an hour or so, and then re-adjust the scope probes.  Should I do a recallibration as well?

[saturation]

FANTASTIC!  You guys are awesome, this is what real EE is all about!

[tinhead]

Yes tinhead, there is now a 200Mhz DSO5102B!  I will let the scope warm up for an hour or so, and then re-adjust the scope probes.  Should I do a recallibration as well?

even if all model are doing self calibration with 125MHz, you still need to recalibrate the DSO.

The TTScope, isn't signed for Win7 ? i believe it is.

and yeah, thanks for the firmware dump, enjoy the 200Mhz BW!

[g***!]

I will try reinstalling the TT scope, in case I have made some fundamental error in the install....I get a no scope connected error, has to be a driver error of some sort. 
Are the Tekway/Hantek firmwares directly interchangeable, what I mean is, if say Tekway brought out an update, could it be applied to a Hantek without having to be modified? 
Many thanks again for the massive effort yesterday, I got quite a surprise when I switched on the PC...to find a working firmware update!

[tinhead]

Many thanks again for the massive effort yesterday, I got quite a surprise when I switched on the PC...to find a working firmware update!

you welcome

Are the Tekway/Hantek firmwares directly interchangeable, what I mean is, if say Tekway brought out an update, could it be applied to a Hantek without having to be modified?  

Before i answer this question let's take a look what inside both DSO:

standard linux dirs:
/bin - no diff
/dev - no diff
/etc - no diff (which is funny, Hantek device is still tagged as Tekway in many scripts)
/lib - new in firmware 2.06.2 is libiconv.so.2.3.0, to support the language switching
/sbin - no diff
/usr - no diff

custom DSO dirs:
/dso/app - no diff
/dso/driver - lcd.ko and fpga.ko updated fw 2.06.2
/usr/bin/gpg149arm - no diif (there is the gpg binary responsible for firmware decryption)
/logo - no diff (there are icns used by DSO UI)
/OurLanguages - this one is new for fw 2.06.2, it contains text files with translation for menu, so in principle you can edit it and add your language
The fw 2.05.xx have hardcoded english/chinese, no really smart but typical for early firmwares

in root dir:

dso.exe - that's the DSO UI, will be started by rcS
fpga.exe - this is a executable used to load/check FPGA
fpga.conf - a very interessting configuration file, depends on settings the FPGA is slower/faster or using different i/o (like for 500MSs models)
help.db - SQLite DB containing help for UI
dn.rbf - FPGA configuration, different for all model families (250MSs models have own, 500MSs have own and 1GSs have own)

and some already mentioned files used for model identification.

The 2.06.2 update script was (you will find this in your fw dump, NAND have always one or more older updates "saved" but visible only in dump):

[DST type]dst1000b
[soft version]2.06.2(101028.0)
[type]123
[cmd] mv /usr/up/tekwayup_client/dso.exe /dso_update.exe
[cmd] rm /logo/ -rf
[cmd] mv /usr/up/tekwayup_client/logo /
[cmd] mv /usr/up/tekwayup_client/dso-lcd.ko /dso/driver/dso-lcd.ko
[cmd] rm /OurLanguages -rf
[cmd] mv /usr/up/tekwayup_client/OurLanguages /
[cmd] mv /usr/up/tekwayup_client/libiconv.so.2.3.0  /lib/libiconv.so.2.3.0
[cmd] rm /lib/libiconv.so.2
[cmd] ln -s /lib/libiconv.so.2.3.0 /lib/libiconv.so.2
[cmd] mv /usr/up/tekwayup_client/help.db /help.db
[cmd] rm /logotype.dis
[cmd] mv /usr/up/tekwayup_client/logotype.dis /logotype.dis
[cmd] rm /sys.inf
[cmd] mv /usr/up/tekwayup_client/sys.inf /sys.inf
[cmd] rm /cur_acq.type
[cmd] sync
[cmd] sync
[cmd] sync
[end]

So in principle yes, currently both firmwares are directly interchangeable - but - that might change.
I would say, don't just download and try to update your DSO, if something geos wrong you will brick your DSO.

For sure, if you have fw backup/dump and JTAG cable you will be able to unbrick your device, but just be warned.

A better way is to check first what inside new firmware, to evaluate it and then to update.
A firmware test can be done on DSO itself :
- connect via UART
- terminate dso.exe (by ctrl+C)
- insert USB stick with decrypted update files (they will be mounted to /mnt folder)
- insmod new .ko modules (if necessary)
- execute new files and test how the device works

Same can be done on Samsung S3C2440 dev board (like FriendyArm 2440), but it is better to do it on DSO just because of
the fact that DSO have all the other hardware (ADCs, FPGA)

To decrypt firmware update:
- download the .up file from Hantek/Tekway website
- download and install GPG
- run gpg -d dstxxxxxxx.up > dstxxxxxx.gz (when asked for password type 0571tekway)
- gunzip the dstxxxxxx.gz
- untar the resulting file (it is dstxxxxxx. )
- untar again the resulting DST1000_4000.tar

To create new/custom firmware
- tar the folder "tekwayup_client" and the upend file to dst1000_4000.up.tar
- tar the resulting dst1000_4000.up.tar to DST1KB_version.tar and remove the .tar extension
  (for example dst1kb_2.06.8(101231.0) )
- Gzip the DST1KB_version to DST1KB_version.gz and remove the .gz extension
- encrypt with gpg -c DST1KB_version (when asked for key type 0571tekway)
- Rename the resulting DST1KB_version.gpg to DST1KB_version.up

What important to know :
- if you type/use wrong password or Tekway/Hantek change the password, your DSO will still not get bricked because the update will get canceled
- use "move" instead of "copy" in "update" script (or chmod 777 filename after copy)
- ensure that whatever inside folder "tekwayup_client" is listed in upend file too
(this means the "upend" file is a list of files and folders contained in "tekwayup_client" folder - but not subfolders and subfiles!)


There is still not clear situation who is ODM and who OEM of these DSOs, which didn't really matter for us.
We know the hardware is identical and we know we can use both firmwares, so who ever write a better firmware - we can use it.

[tinhead]

another one screenshot ...
My previous bw measure was done with 1ns rise time generator, which is normally not sufficient (due cable, terminator loss).

So here we are, i did build the 250ps generator (well, at least on my 500MHz scope it shows 550ps rise time)
and made some measurments on the Tekway/Hantek DSO. The result is 1.3ns which is equal to 270MHz -3db bw.

EDIT: on the snapshot is 1.250ns, so it is between 1.25ns and 1.30ns, but the worst value counts.

[saturation]

NICE, tinman, what did you use generate 250ps?

another one screenshot ...
My previous bw measure was done with 1ns rise time generator, which is normally not sufficient (due cable, terminator loss).

So here we are, i did build the 250ps generator (well, at least on my 500MHz scope it shows 550ps rise time)
and made some measurments on the Tekway/Hantek DSO. The result is 1.3ns which is equal to 270MHz -3db bw.

[alm]

So here we are, i did build the 250ps generator (well, at least on my 500MHz scope it shows 550ps rise time)
and made some measurments on the Tekway/Hantek DSO. The result is 1.3ns which is equal to 270MHz -3db bw.

Did you verify the amplitude with your 500MHz scope? Rise time is measured from 10% to 90% of the signal amplitude, so if the scope shows a lower amplitude due to the attenuation of the high-frequency component, the apparent rise time will be higher. A step is much easier to use than a pulse for this reason.

[tinhead]

NICE, tinman, what did you use generate 250ps?

the Linear Technology, App Note 47.

I didn't had LT1073 but 1073-5 so changed some Rs values in 90V power supply part, but the rest is the same.

[saturation]

Wonderful, and thanks so much for appending the app note pdf too.

NICE, tinman, what did you use generate 250ps?

the Linear Technology, App Note 47.

I didn't had LT1073 but 1073-5 so changed some Rs values in 90V power supply part, but the rest is the same.

[tinhead]

Did you verify the amplitude with your 500MHz scope? Rise time is measured from 10% to 90% of the signal amplitude, so if the scope shows a lower amplitude due to the attenuation of the high-frequency component, the apparent rise time will be higher. A step is much easier to use than a pulse for this reason.

well actually this is like apple and pear, a scope with higher BW will show evtentually** higher amplitude
On the other side 10%/90% are from measured signal amplitude and not the real amplitude.

The only common BW limiter on both DSOs is 20MHz, with such setting both are displaying ~2.5ns rise time and 1Vp.

My result is exact what Tekway/Hantek did specified for 200MHz models, so it isn't something new, it is just a proove of this hack.


** The 250ps rise time are far beyond both DSOs bandwitdh, at least 4-6GHz DSO is necessary to measure such
high rise time/amplitude signal with accuracy lower than 5%.

[alm]

well actually this is like apple and birnes, a scope with higher BW will show evt. higher amplitude. On the other side 10%/90% are
from measured signal amplitude and not the real amplitude.

Just to elaborate why I think amplitude matters:
Assume a really fast (say 250ps 10-90 rise time on a sampling scope with a much faster rise time than that) pulse, and a step (eg. 1kHz square wave, which is much slower than the edge rate) with the same rise time. The step will have a rise time of about 1.75ns on a 200MHz Gaussian scope.

Now replace the step by a pulse. The rise time won't be 1.75ns, since the total pulse with is narrower than that. The pulse will start to fall before the scope's vertical amplifier reached the top. Did the scope just become faster?

Using pulses for bandwidth measurement is hard, in my opinion, which is why Jim Williams made an improved version with charge line. It should be fine for relative tests, but I wouldn't rely on the actual numbers.

[tinhead]

It should be fine for relative tests, but I wouldn't rely on the actual numbers.

Well yes, i did posted before measurments done with 10MHz/1ns rise time square generator, it was still good enough (1.8ns)

The AN47 pulse generator can be easy build by everybody, the rise time will probably vary a bit (but still much faster than most low costs DSOs are)
so a good base for relative comparison of such DSOs.

[eecfans]

Really interesting ha. they are useful info for me, because I may have to find a new replacements, too. Tks.

[tinhead]

Finally i got official answer from Tekway and Hantek.
Both companies have same shareholders and since few months sharing development team (welcome to "cost reduction" world),
but they still independant, so both will continue to produce DSOs under own company name.

The SDK kit (for both Hantek and Tekway) is scheduled to be released end of Jauary 2011,
the firmware source code (which is under GPL and have to be published) will be not published,
this seems to be GPL licensing misunderstanding so i will try to explain again both companies what's about.

Hantek have currently no 60MHz devices in stock, just because they not started yet with the production,
the answer is "60MHz device will follow".

Tekway have some 60MHz in stock (over official distributors - see my first post, or directly),
but it seems that there are more people asking for 100/200MHz devices than for the 60MHz.

Personally i think both companies have issues due the components market situation to get components in time, so probably
they prefer to sell higher models to earn more, but that's fair enough.

[GeoffS]

The SDK kit (for both Hantek and Tekway) is scheduled to be released end of Jauary 2011,
the firmware source code (which is under GPL and have to be published) will be not published,
this seems to be GPL licensing misunderstanding so i will try to explain again both companies what's about.

Send an email off to this group. They'll do the chasing up about GPL compliance.

[tinhead]

The SDK kit (for both Hantek and Tekway) is scheduled to be released end of Jauary 2011,
the firmware source code (which is under GPL and have to be published) will be not published,
this seems to be GPL licensing misunderstanding so i will try to explain again both companies what's about.

Send an email off to this group. They'll do the chasing up about GPL compliance.

for now i did analyzed first what under GPL and what not, made a list of all files/modules/libraries and send it to Tekway/Hantek
with a full description. Now it would be easier to understand for them.
Depends on answer i will of course contact gpl-violations.org and/or softwarefreedom.org.

[Gall]

Do they link their proprietary executables statically and/or with GPL (not LGPL) libraries? If yes, they have to publish sources or at least linkable object files of these executables as well.

[tinhead]

Do they link their proprietary executables statically and/or with GPL (not LGPL) libraries? If yes, they have to publish sources or at least linkable object files of these executables as well.

All proprietary executables are dynamically linked, except customized gpg (which will be used for automatic firmware decryption during update), but as the secret key is already known should be not a bid deal to publish the source. Tekway/Hantek know about this hack
and about what we already know/looking for.

[tinhead]

HACK UPDATE
I did updated some stuff and changed all ref. postings to have all hacks/tools in single place

--------------------------------------------------------------------------------------------------------------------------------

Firmware update for Tekway users
This is inofficial version, it will update all Tekway DSO to firmware version 2.06.2
- French/German/Chinese/English menu language supported instead of only Chinese/English
- CSV export to USB (up to 40k samples only, but better than nothinig)
- a bit better export menu (much easier to recognize what your saving)
- more colors for menu/submenu/background (black/green/pink/yellow/blue instead of only blue)
- trigger works now stable up to 300MHz (of course after hacked to 200MHz bw)
- zoom up to 1000x
This firmware update is replacing only binaries, nothing will be hacked or changed.
How to use :
- download attached do_firmware_Tekway_2.06.2.exe and do_firmware_Tekway_2.06.2.r00
(it is packed with WinRAR just because of size limit here in forum)
- unrar or execute it and copy dst1kb_2.06.2_cli(101028.0).up to your USB stick and proceed with firmware update
- reboot, recalibrate your DSO
removed since never firmware available
--------------------------------------------------------------------------------------------------------------------------------

Generic Tekway hack
Hack is now updated to work with any Tekway firmware versions, it will change your DSO model but it will not anylonger replace any binary files
How to use:
- download one of the attached version
   do_Tekway_DST1062B.zip - if you wish to change your DSO to DST1062B (60MHz bw)
   do_Tekway_DST1102B.zip - if you wish to change your DSO to DST1102B (100MHz bw)
   do_Tekway_DST1202B.zip - if you wish to change your DSO to DST1202B (200MHz bw)
- unzip and copy the dst1kb_9.99.9_cli(111111.0).up to your USB stick and proceed with firmware update
- reboot and recalibrate your DSO

--------------------------------------------------------------------------------------------------------------------------------

Generic Hantek hack
Hack is now updated to work with any Hantek firmware versions, it will change your DSO model but it will not anylonger replace any binary files
How to use:
- download one of the attached version
   do_Hantek_DSO5062B.zip - if you wish to change your DSO to DSO5062B (60MHz bw)
   do_Hantek_DSO5102B.zip - if you wish to change your DSO to DSO5102B (100MHz bw)
   do_Hantek_DSO5202B.zip - if you wish to change your DSO to DSO5202B (200MHz bw)
- unzip and copy the dst1kb_9.99.9_cli(111111.0).up to your USB stick and proceed with firmware update
- reboot and recalibrate your DSO

I don't have DSO5062B and DSO5202B boot screen logos, so your DSO will always show during boot DSO5102B.
If you have such logos please let me know. If you wish to change the DSO5102 logos (see attached hantek_logo.zip content)
to "proper" name, then do it and send them back to me (so i will update again this hack).
I would do it, but i prefer to spend my time on other things

I got the proper logos for DSO5102B and DSO5202B, for DSO5062B is did my own. Generic hacks in below updated now.

not working anylonger, use UART to hack

--------------------------------------------------------------------------------------------------------------------------------

Firmware Dump utility
as already posted here:
https://www.eevblog.com/forum/index.php?topic=1571.msg23807#msg23807
this tool has been again updated

again updated to work with fw 2.6.x and higher?

https://www.eevblog.com/forum/index.php?topic=1571.msg35683#msg35683

--------------------------------------------------------------------------------------------------------------------------------

Firmware Update Counter Reset
This tool will reset fw-update and DSO-usage counter to 0 on your Hantek/Tekway DSO.
How to use:
- download attached do_ResetUpdateCounter.zip
- unzip and copy the dst1kb_9.99.9_cli(111111.0).up to your USB stick and proceed with firmware update
- reboot and recalibrate your DSO

NOTE: This tool is deleting sys.inf from your DSO root file system. All currently known firmware versions are re-creating this file during reboot,
however be warrned that i'm not responsible for any modifications done by you.

not working, use UART to delete sys.inf

--------------------------------------------------------------------------------------------------------------------------------

ALL Hacks/tools has been tested on both Tekway and Hantek DSOs (DST1xxxB series and DSO5xxxB series) with all currently known
firmware versions, however i'm still not responsible for any resulting issues (warranty, bricked DSO, whatever).

If you brick your DSO with one of in above posted hacks/tools you will still be able to un-brick it via JTAG. "ARM JTAG cable for H-JTAG"
costs 10$, e.g. ebay item 300453556955
If you don't want to play with JTAG and wish to unbrick your DSO, unsolder the NAND memory (K9F1208xxx) and send it to
me (i'm located in Europe ...), i can definitely reprogram the NAND with working firmware (however you will have to know how
to unsolder/solder such IC). A empty NAND will not work, there is some factory calibration data stored, so it is always recommended to have a original firmware backup (created via JTAG/UART or with the "Firmware Dump utility" hack/tool)