Hantek - Tekway - DSO hack - get 200MHz bw for free

[villamany]

Hi guys, after several tries seems finally i got my DSO5102P "hacked to 200MHz". I bought it brand new at February 2020.

The serial pinout is here:

]https://i.imgur.com/XfhNmP6l.jpg[/url]]https://i.imgur.com/XfhNmP6l.jpg

The how to do is here: http://tefatronix.g6.cz/display.php?page=hantek&lang=en

Some tips:
-I didnt see the "dso1102b" file on my scope but i see a "dst1102b" file that i renamed to "dst1202b".
-My "sys.ini" file doesnt contain any data so i didnt change nothing here.
-Note i got several calibration errors until i removed all data of the i2c.log file leaving only the chars posted in the link plus a 0x0A after each line (a lot of 0x00 garbage bytes i removed at beginning, middle and end of the file)

[deisenberg]

Well I bricked mine good (MSO derivative).  No UART output now. Is this fixable via JTAG? I backed up via a USB key.

[acdrvc]

Hi, first post here. sorry about the long post.
I can tell you that the eeprom hacking method posted by villamany is not for the faint hearted, there is a real risk of bricking your oscilloscope, so if you follow the website instructions (http://tefatronix.g6.cz/display.php?page=hantek&lang=en) do it carefully. I have spent hours fixing a recovery loop, and after sucessfully modding the eeprom it still wasn't the right way, so it couldn't perform self calibration without success, it gave error 0x802.
Here is how i managed to do it.

Get acess to the console via rs232 adapter connected to the pcb, the pads near the usb connector
use Putty, or similar and get the i2c.log file copied to the usb stick. insert usb stick on your computer.

I use windows so i edited the file with HxD hex editor.

On top of the HxD editor you will see a window that reads "Windows(ANSI)", select in the dropdown list "DOS/IBM-ASCII(OEM)" so you can see the unix line terminators "◙" on each line.
Delete all 0x00 entries until the "[" character in "[--LOG0--], there is usually a bunch of 0x00 in the middle of the file, erase them too, and also at the end of the file, after "[bw]200◙".

So your file should look like this on HxD (the serial number is censored ):


save it as i2c.org and connect stick to the dso.

Continue with the site instructions and reboot the dso when you're finished.
Now comes the important part. if the first message after rebooting the dso is not "formatting e2prom" but "backing e2prom", or self calibration fails then your file is not edited right(see image above), take special precaution with extra spaces or missing characters, it must be exactly like the image above, no more, no less.

If it is stuck in a recovery loop, connect via terminal(rs232 to usb adaptor) and choose on the dso the recovery option and wait, when "backing i2prom" or "formatting i2prom" appear on the dso screen hit killalll dsod, two times to be sure...

and copy i2c.org on the usb stick to both i2c.org and i2c.log:

cp /mnt/udisk i2c.org i2c.org
cp /mnt/udisk i2c.org i2c.log
touch i2c.format
sync
reboot

See if the dso reboots and "format e2prom" appears normally and after that it reboots normally, if so perform the self calibration, it should pass with success, if not, take your time evaluate your modded i2c.log file with patience, like the site said, a single misplaced character can brick or make your dso fail self calibration.
Simply don't rush it, take time and do it carefully.

[martinisonline]

There is a recent version for the Hantek P5000 series on the site from 24-10-2019.
dso5kp_func_dso5102p20191024

Did someone already test it? No log description as usual

[ADZ]

Hello. Anybody can upload voltcraft_dso3000series.zip that was located at http://ftp.gpl-devices.org/pub/vendors/Voltcraft/VOLTCRAFT_dso3000series.zip

[Level42]

Hey guys,

Thanks to this thread I hacked my Voltcraft DSO-1062D many moons ago but I was wondering if there was a newer firmware version now (because there are some rather "rough edges" in the older firmware ) and if I can upgrade without loosing the 200Mhz hack.

Current SW version is 3.30.0 (140111.0)

My questions:
- should I stick with the Voltcraft firmware versions as I can find on the Voltcraft site: http://voltcraftdownload.info/Default.aspx?modelno=DSO-1062D  or should I go with a later Hantek version ?
- are there any new cool hacks ?

[Ulle]

Hi. Today I get my new DSO5102P, so it's a current model. I would like to expand this to 200 MHz. Do I understand correctly that I ONLY have to change the i2c.org EEPROM file (0x00 and [bw] 200)? Or is that an additional step before the old standard procedure? Thank you!

[Level42]

About my last posting: I discovered that the Voltcraft firmwares are the same as the Hantek ones and I simply used the version for the 200Mhz model, all went without problems, but I have no idea what has changed....I guess some bugs were fixed like menus etc. It’s annoying that there are no logs that show what changes have been made....o well...

[robert.rozee]

i'm posting to this thread as it seems to be the place where all Hantek DSO5xxxP discussion goes on - hopefully no one minds what is a bit of an off-topic request!

i've got a Hantek DSO5072P (actually a 5102) with very blown switchmode power supply here, that belongs to a friend of mine. while repairing the power supply isn't impossible, i've been discussing with him the idea of converting the scope to battery operation instead of attempting any repair; cheap switchmodes are cantankerous devices at best, and it strikes me that battery operation may well be more useful.

for photos of the same PSU as i'm working with, with an identical failure mode, see this thread:
https://www.eevblog.com/forum/repair/hantek-dso5072p-power-issue/


so... if anyone reading this has a DSO5000P series scope that they have opened up, i'd be very keen to find out what the approximate current draw on the various supply rails is, these being: +14v, -8v (analog), +5v, +3v3 (digital).

the PSU is labelled as:
"DSO5000 SERIES POWER
Data: 3013/05
Ver 1.0",
indicating perhaps a hw version 1010?


my thinking is that in theory it should be possible to simply cobble together something based upon buck/boost modules from ebay: a 7.2v NiMh battery pack (6-cells) bucked down to 5v with a LM2596 module, and then a linear regulator down to 3v3. a small +/-12v module swinging about 3v3 could then give +15.3v/-8.7v for the analog stuff, provided the current requirement is suitably low.


many thanks for any info about the current draw from DSO5072P series owners.

cheers,
rob   :-)

[Lesheg]

Hello. After an unsuccessful firmware update of my DSO 5102B hw1010, I restored it through JTAG. In H-Flasher I chose the type: main-only, since my backup does not contain oob data. I tried after this a nandump without -o key, and oob data blocks contain only FF. But the scope now is working. Can something happen to my device in the future after such recovery without oob data?

[nakunda]

anyone knows the hw version or pcb version to use with the DSO tool for DSO8202E?
accidentally written 1007

[nakunda]

found.

DSO8202E，sw version 3.2.35（171121.0），hw version 1080*900383eb04

[david.ercoli]

Hello group:

I recently bought a Hantek oscilloscope model Dso4104b.

My question is, do you know if there is a hack for these model?

Thank you, best regards!

[Microcheap]

Hello group:

I recently bought a Hantek oscilloscope model Dso4104b.

My question is, do you know if there is a hack for these model?

Thank you, best regards!

Yes, check this thread: https://www.eevblog.com/forum/testgear/upgrading-the-hantek-dso4072c-osciloscope-bandwidth-from-70mhz-to-200mhz/

[Evgeni62]

Hello to all! Did anyone manage to run it on DSO5102B LAN - so that it would work? Thank.

[Evgeni62]

Those of you that have done the LAN mod do you happen to have the part number for the ethernet port? Besides the PHY are there any other parts needed?

Amphenol RJHSE-5381

[mhi]

I am considering purchase of some new low-end scope to space on my desk. Either some Hantek or Micsig tBook ("tablet" scope). One of things I would like to try to do is to modify the "main scope app" (firmware) to do some additional jobs. I have not digged into this yet, just looked at some firmware dumps. For Micsig scopes I have "oscillo_pad" Linux executable with full debug symbols (which is linked against Qt btw), making it quite easy to analyze. I am looking for dso.exe with enabled debug symbols, has anyone got such file ?

Also is there any info about Hantek/Micsig FPGAs available, at least how are they connected in the system?

[mzs66]

Hi All,

could anybody share or send me the Hantek Rescue tool?

Thanks in advance

[veskon]

Hello! I need your help.
My DSO5062B was broken when it was connected to bad power soket. DSO turned on and off 1-2minutes. And now DSO is stoped in the middle of the start initialization.
I found this guide for firmware fixing https://marcowuen.wordpress.com/2013/09/01/dso-hacking-quick-guide-voltcraft-dso3062c-hantek-dso5062b-tekway-dst1062b/ and I got the next report:

//////////////
***ARM CPU 400MHz BUS 100MHz (DST1000B bootloader)****(091102)
Tekway Bootloader (modify from mizi vivi)v0.10.0 (root@rain-fc4) (gcc version 2.95.3 20010315 (release)) #0.1.4 Tue Dec 1 10:51:38 CST 2009
UPLLCON  : 0x56022
MMU table base address = 0x33DFC000
NAND device: Manufacture ID: 0xec, Chip ID: 0x76 (Samsung K9D1208V0M)
Found default  parameters
GPfcon :0x5555
Press Return to start the LINUX now, any other key for Bootloader
from : 0x50000, size :0x200000, media_type:0x3
done
zImage magic = 0x016f2818
Setup linux parameters at 0x30000100
linux command line is: "noinitrd root=/dev/mtdblock2 init=/linuxrc console=ttySAC0"
MACH_TYPE = 782
NOW, Booting Linux......
Uncompressing Linux... done, booting the kernel.
Linux version 2.6.13 (root@rain-fc4) (gcc version 3.4.1) #3 Wed Jun 29 10:13:03 CST 2011
CPU: ARM920Tid(wb) [41129200] revision 0 (ARMv4T)
Machine: QQ2440
ATAG_INITRD is deprecated; please update your bootloader.
Memory policy: ECC disabled, Data cache writeback
CPU S3C2440A (id 0x32440001)
BUG: mapping for 0x19000000 at 0xd0000000 overlaps vmalloc space
S3C2440: core 405.000 MHz, memory 101.250 MHz, peripheral 50.625 MHz
S3C2410 Clocks, (c) 2004 Simtec Electronics
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 64, 32 byte lines, 8 sets
CPU0: D cache: 16384 bytes, associativity 64, 32 byte lines, 8 sets
Built 1 zonelists
Kernel command line: noinitrd root=/dev/mtdblock2 init=/linuxrc console=ttySAC0
irq: clearing pending ext status 0000c000
irq: clearing subpending status 00000002
PID hash table entries: 512 (order: 9, 8192 bytes)
timer tcon=00000000, tcnt a4ca, tcfg 00000200,00000000, usec 00001e57
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 64MB = 64MB total
Memory: 61184KB available (2499K code, 1009K data, 100K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
USB Power Control, (c) 2004 Simtec Electronics
S3C2440: Initialising architecture
S3C2440: IRQ Support
S3C2440: Clock Support, UPLL 48.000 MHz
SCSI subsystem initialized
usbcore: registered new driver hub
S3C2410 DMA Driver, (c) 2003-2004 Simtec Electronics
DMA channel 0 at c4800000, irq 33
DMA channel 1 at c4800040, irq 34
DMA channel 2 at c4800080, irq 35
DMA channel 3 at c48000c0, irq 36
NetWinder Floating Point Emulator V0.97 (double precision)
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
yaffs Jun 29 2011 10:09:19 Installing.
Initializing Cryptographic API
Console: switching to colour frame buffer device 100x30
S3C24X0 fb0: s3c2410fb frame buffer device initialize done
GPIO L3 bus interface for S3C2440, installed
S3C2410 RTC, (c) 2004 Simtec Electronics
s3c2410-rtc s3c2410-rtc: rtc disabled, re-enabling
s3c2410_serial0 at MMIO 0x50000000 (irq = 70) is a S3C2440
s3c2410_serial1 at MMIO 0x50004000 (irq = 73) is a S3C2440
s3c2410_serial2 at MMIO 0x50008000 (irq = 76) is a S3C2440
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: loaded (max 8 devices)
nbd: registered device at major 43
Cirrus Logic CS8900A driver for Linux (Modified for SMDK2410)
eth0: incorrect signature 0x0000
Linux video capture interface: v1.00
ovcamchip: v2.27 for Linux 2.6 : OV camera chip I2C driver
Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2
ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
S3C24XX NAND Driver, (c) 2004 Simtec Electronics
s3c2410-nand: mapped registers at c4880000
30 ns is too big for current clock rate 101250
s3c2410-nand: timing: Tacls 0ns, Twrph0 4294ns, Twrph1 0ns
NAND device: Manufacturer ID: 0xec, Chip ID: 0x76 (Samsung NAND 64MiB 3,3V 8-bit)
NAND_ECC_NONE selected by board driver. This is not recommended !!
Scanning device for bad blocks
Creating 3 MTD partitions on "NAND 64MiB 3,3V 8-bit":
0x00000000-0x00030000 : "bootloader"
0x00050000-0x00250000 : "kernel"
0x00250000-0x03ffc000 : "root"
s3c2410-ohci s3c2410-ohci: S3C24XX OHCI
s3c2410-ohci s3c2410-ohci: new USB bus registered, assigned bus number 1
s3c2410-ohci s3c2410-ohci: irq 42, io mem 0x49000000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
usbcore: registered new driver usbhid
drivers/usb/input/hid-core.c: v2.01:USB HID core driver
usbcore: registered new driver ov511
drivers/usb/media/ov511.c: v1.64 for Linux 2.5 : ov511 USB Camera Driver
usbcore: registered new driver gspca
drivers/usb/media/gspca/gspca_core.c: gspca driver 00.60.00 registered
mice: PS/2 mouse device common for all mice
ts: Compaq touchscreen protocol output
s3c2410 TouchScreen successfully loaded
i2c /dev entries driver
S3C2410_GPECON : 0Xa00002aa , S3C2410_GPEUP: 0X0
rIICCON :0Xaf
open driver log file error!!
dso-i2c: xx install ok
SBC2440 SOUND driver register
SBC2440 SOUND driver probe!
SBC2440 UDA1341 audio driver initialized
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
yaffs: dev is 32505858 name is "mtdblock2"
yaffs: Attempting MTD mount on 31.2, "mtdblock2"
VFS: Mounted root (yaffs filesystem).
Mounted devfs on /dev
Freeing init memory: 100K
rm: can't remove '/usr/udisk-flag': No such file or directory
CPU 400MHZ BUS 100MHZ
dso-iobank: install ok
<k>hantek_DSO5062B
dso-lcd installed lcd module ok
Segmentation fault
kobject_register failed for usb_storage (-17)
insmod: can't insert '/dso/driver/dso-usbstorage.ko': File exists
usb_device: module license 'unspecified' taints kernel.
S3C2410 USB Controller Core Initialized
USB Function Character Driver Interface - 0.5, (C) 2001, Extenex Corp.
usbctl: Opened for usb-char
usbctl: Started for usb-char
usbcore: registered new driver usblp
drivers/dso_drivers/usblp.c: v0.13: USB Printer Device Class driver
bwscon:0x2211d110
fpga bank 11811
dso-fpga: install ok
kobject_register failed for s3c2440-i2c (-17)
dso-i2c: can't register device
insmod: can't insert '/dso/driver/dso-i2c.ko': Device or resource busy
x gpio e: 0xaa0002a6, gpio g :0xfd62f19a , gdata:0x6f8f
dso-spi: install ok
dso-uart: install ok
dso-buzzer: install ok
Segmentation fault
Segmentation fault
no update file to foud
now run app .....
Segmentation fault

Please press Enter to activate this console.
//////////////

DSO still doesn't work and I have no idea how fix it. Please help!

[Microcheap]

DSO still doesn't work and I have no idea how fix it. Please help!

When these oscilloscopes are turned off during boot the file system can get corrupted and it will hang during initialization. Have you already tried to restore the system?
See this msg in Hantek's forum for reference: https://www.eediscuss.com/forum.php?mod=redirect&goto=findpost&ptid=15009&pid=19633&fromuid=26055

If the restoration process fail, simply send an e-mail to Hantek's support that they will send you the files to recover the partition.

[Yhoni]

Hello, I have been able to modify the speed of my Hantek DSO5102P to 200Mhz.

Everything works correctly. 

Thanks to the information and work that you share.

Thank you very much.

[Perepandel]

Hi! I registered exclusively to ask if anyone knows about the "new" supposed Hantek models (DSO2X1X), which I've seen around in AliExpress and appear to be a huge improvement over the DSO5XX2 models, mainly in terms of memory (8M) and including an integrated function generator (only D models), as well as serial decoding.

I've purchased myself one of those, but unfortunately only the 100 MHz was available (DSO2D10) and I didn't want to miss what looked like a good deal. I wish it could be hacked also, as my goal was the 150 MHz model (DSO2D15).

Anything regarding both general info about these models and/or with their hacking process will be much appreciated 

[xthanhn]

Hi,

I have just updated my Hantek DSO1062B handheld with the newest firmware from hantek's site 2.01.1 (130129.0) and discovered several bugs (when beep is on and you move cursor, it beeps even if you push and hold the direction buttons, trigger level is erratic - it sets lower trigger level than indicated), and I want to go back to the older firmware.

Does anyone have a firmware older than 2.01.1 (130129.0)? My older was 2.01.1 (12xxxxx.x), and it was OK, more or less, but I don't have it anymore and I cannot revert back to it.

Thanks.

Hi sparkybg ,
My DSO1062B has brick, I dont know how to recover device by firmware backup (boot.bin, kernel.bin, root.bin, root2.bin) because it is different than other DSO. Do you have fw_backup.bin file? Could you please share it to me?

Thank a lot.
Michael

[Freeze]

Hey guys, nice to see, that this thread is still active!

After several years, now I'm experiencing some problems with my Hantek DSO-5062B...
The buttons on the front are not working any more.

During boot, shortly an error message box appears:
"Hardware Init Error Code 0x01"

I didn't make any changes onto the software. This problem occured suddenly.

My first try was to open the device and reinsert all cables. Didn't help.
Second try was to reflash my firmware backup using UART/USB, but that didn't help either.

Now I would like to update the firmware, but I'm stuck.
The normal firmware update process works using the onscreen utility, but - as already stated - my buttons are not working.
Any idea how I can flash this firmware using UART/USB?
This file seems to be only a part of the whole firmware, since the original firmware has 66MB.
So I'm not sure which files I need to combine to have a complete firmware which I can flash using supervivi.


/e: Update...
I was able to decrypt the firmware using password "dst5000b".
Afterwards I unzipped and copied all files to USB flash drive.
Inserted the drive and manually updated the device by processing all steps listed in do_update.sh manually.
"dso.exe" and "dsod" cannot be started now, though both files are 777 and +x.
Seems the firmware is not compatible O,o

I noticed: Old dso.exe has 4MB and new one has only 1.5MB... strange.
But.. I don't think this is a software problem. This is just my last resort xD
Maybe I try to remove the whole keyboard unit to see if there are obvious problems.

Hm.. just noticing. Maybe it's no problem with the keyboard but a general problem with dso.exe or the scope itself. Because I can't see any waveforms (even with the test signal). The screen seems to be frozen.
No idea what may be the root cause...

I fear I will switch to Rigol DS1054Z...
https://geizhals.de/rigol-ds1054z-digital-oszilloskop-a1218892.html

/e: I've created a thread on eediscuss.com:
https://www.eediscuss.com/forum.php?mod=viewthread&tid=15326&extra=page%3D1

[xthanhn]

Hey guys, nice to see, that this thread is still active!

After several years, now I'm experiencing some problems with my Hantek DSO-5062B...
The buttons on the front are not working any more.

During boot, shortly an error message box appears:
"Hardware Init Error Code 0x01"

I didn't make any changes onto the software. This problem occured suddenly.

My first try was to open the device and reinsert all cables. Didn't help.
Second try was to reflash my firmware backup using UART/USB, but that didn't help either.

Now I would like to update the firmware, but I'm stuck.
The normal firmware update process works using the onscreen utility, but - as already stated - my buttons are not working.
Any idea how I can flash this firmware using UART/USB?
This file seems to be only a part of the whole firmware, since the original firmware has 66MB.
So I'm not sure which files I need to combine to have a complete firmware which I can flash using supervivi.


/e: Update...
I was able to decrypt the firmware using password "dst5000b".
Afterwards I unzipped and copied all files to USB flash drive.
Inserted the drive and manually updated the device by processing all steps listed in do_update.sh manually.
"dso.exe" and "dsod" cannot be started now, though both files are 777 and +x.
Seems the firmware is not compatible O,o

I noticed: Old dso.exe has 4MB and new one has only 1.5MB... strange.
But.. I don't think this is a software problem. This is just my last resort xD
Maybe I try to remove the whole keyboard unit to see if there are obvious problems.

Hm.. just noticing. Maybe it's no problem with the keyboard but a general problem with dso.exe or the scope itself. Because I can't see any waveforms (even with the test signal). The screen seems to be frozen.
No idea what may be the root cause...

I fear I will switch to Rigol DS1054Z...
https://geizhals.de/rigol-ds1054z-digital-oszilloskop-a1218892.html

/e: I've created a thread on eediscuss.com:
https://www.eediscuss.com/forum.php?mod=viewthread&tid=15326&extra=page%3D1

Nice try, just contact caiyijun@hantek.com he/she will give you factory file to reflash.
Rigol DS1054z is good, I have had one, can make it from 50mhz to 100mhz with some easy command.
good luck!

My DSO1062B after brick