Hantek - Tekway - DSO hack - get 200MHz bw for free

[SoftwareSamurai]

Okay, well, back to modding my DSO5102B via the USB Update Firmare...

More info for everyone: (Remember I've got the 2.06.2 firmware.)

Finally got it to work! Turns out the only hitch was that if you include a file named logotype.dis in the .up file, it will be checked for the correct "hantek_DSOxxxxx" label inside. But if you simply rename it to something else (I just renamed it l), it won't be checked. And like I've mentioned before, you only need the update file listed in the upend file. You can include other files without listing them in the upend file since it's all untarred en-masse. Then in the update file, you just need to do something like this:

Code: [Select]

[cmd] cp -f /usr/up/tekwayup_client/l  /logotype.dis
[cmd] chmod 766  /logotype.dis
And you're good to go.

Now as an interesting side-effect, once I've modding my DSO5102B to a DSO5202B, the Update Firmware now fails because it thinks the system is a DSO5202B but the update file is for a DSO5102B. Changing the [DST type] line in the update file doesn't appear to fix it. Hmmm...

Update: Ah, turns out the Update Firmware assumes that the update is for a DSO5102B if there's no logotype.dis file in the .up file! So if you just add a logotype.dis file with "hantek_DSO5202B" in it, it works. So it's possible to create 2 .up files: one for DSO5102B->DSO5202B and one for DSO5202B->DSO5102B. (The latter would be good to have if/when a newer firmware comes out!)

[project]

Okay, well, back to modding my DSO5102B via the USB Update Firmare...

Finally got it to work! Turns out the only hitch was that if you include a file named logotype.dis in the .up file, it will be checked for the correct "hantek_DSOxxxxx" label inside. But if you simply rename it to something else (I just renamed it l), it won't be checked. And like I've mentioned before, you only need the update file listed in the upend file. You can include other files without listing them in the upend file since it's all untarred en-masse. Then in the update file, you just need to do something like this:

This is nice information. Even I like to do UART more.

[project]

And about Serial Number of the machine.
I haven't figure out where they hide the SN information, definitly not sys.inf. But the 'i2c.log' is where they store the SN update or say i2c op log, that means it's stored in i2c programable chip. My 5102b was T 1G/200m xxxxxx in last OCT in i2c.log which is same on back lable. They factory change the SN to T 1g/100m xxxxxx in last Dec when they ship to distributor. Check yours you may lucky as mine.

Mine got from taiwan distributor(you can find contact information on hantek web site) as cash no invoice price NT$13400 that's about $450-460(This is about $50-60 higher than you can get from China by cash no tax price, but to me it's a trustable source). you can ask him if he can ship and how the price gos. It's 5102b(factory hacked from 5202b) english front panel and multi-lang 2.06.2.

[tinhead]

Allah help us ... all you have to know about how the firmware check is already in the fwdump tool, just read it.

In pirnciple the check is simple :

just ensure you update file is same as update~, sys.inf same as sys.inf~ and logotype.dis same as logotype.dis~ (talking now about files for your self-made firmware).

Then ensure that for these lines are inside in the update script:

[cmd] rm -f /logotype.dis
[cmd] mv /usr/up/tekwayup_client/logotype.dis /logotype.dis
[cmd] rm /sys.inf
[cmd] mv /usr/up/tekwayup_client/sys.inf /sys.inf
[cmd] rm -f /cur_acq.type
[cmd] touch ubdb.swi
[cmd] rm -f /dst1*
[cmd] touch /dst1202b
[cmd] chmod 777 /dst1202b
[cmd] chmod 777 /*
[cmd] chmod 777 *
[cmd] sync
[cmd] sync
[cmd] sync
[end]

So, if you wish to build own usb hack, all you have to do is to create own logotype.dis with whatever model number (same rule for Tekway or Hantek),
then you have to copy it to your self-build firmware as whatever file name (just don't use logotype.dis or logotype.dis~ names),
then you have to change the update script as following

[cmd] rm -f /logotype.dis
[cmd] mv /usr/up/tekwayup_client/logotype.dis /logotype.dis
[cmd] rm /sys.inf
[cmd] mv /usr/up/tekwayup_client/sys.inf /sys.inf
[cmd] rm -f /cur_acq.type
[cmd] touch ubdb.swi
[cmd] rm -f /dst1*
[cmd] touch /dst1202b
[cmd] chmod 777 /dst1202b
[cmd] chmod 777 /*
[cmd] chmod 777 *
[cmd] sync
[cmd] sync
[cmd] sync
[cmd] mv /usr/up/tekwayup_client/yourcustomlogotype.dis.file /logotype.dis
[cmd] sync
[end]

The fw currently didn't care/check other files, only what described in above. Of course the model inside logotype.dis and logotype.dis~
in your custom firmware MUST match your model (the one from what you will hack, so if you already hacked but wish to hack-back use the new model name) and the [cmd] touch /dst1202b and [cmd] chmod 777 /dst1202b lines must match destination model.

That's all. As said before, for each target model one custom firmware will be necessary (per destination model),
increasing the amount of necessary self-made usb hack files - which is bad for new users.
UART is still the best way, you can't destroy anything and you have full controll over the process.
Custom firmwares are always risky, if you forget to change for example permissions for copied files the DSO might not start,
for a beginner a disaster.


Regards serial number, yes it is stored in eeprom connected to s3c2440, it is easy to change it.
I don't tell you how, but i can tell you one thing - up to last 4 serial numbers and up to last 4 firmware updates are stored in NAND
memory - so whatever so do, be ensure you have a backup of your original NAND content (to be able to restore it i case of warranty).
Yes - the NAND backup contains serial number too, after it has been restored the DSO.exe will write it to EEPROM.

[project]

it is stored in eeprom connected to s3c2440, it is easy to change it.

No worry, I figured out already, LCD ribbon block the view of that 4L64i. Just not necessary for now. I never touch an ARM, may be need learn a little about min2440 to know the whole system before do anything wild.

But another thing bug me know, while checking my boot log, looks my NAND has a bad block. Can you please confirm with me?

S3C24XX NAND Driver, (c) 2004 Simtec Electronics
s3c2440-nand: mapped registers at c4880000
s3c2440-nand: timing: Tacls 9ns, Twrph0 39ns, Twrph1 9ns
NAND device: Manufacturer ID: 0xec, Chip ID: 0x76 (Samsung NAND 64MiB 3,3V 8-bit)
NAND_ECC_NONE selected by board driver. This is not recommended !!
Scanning device for bad blocks
Bad eraseblock 1518 at 0x017b8000
Creating 3 MTD partitions on "NAND 64MiB 3,3V 8-bit":
0x00000000-0x00030000 : "bootloader"
0x00050000-0x00250000 : "kernel"
0x00250000-0x03ffc000 : "root"

..........

NET: Registered protocol family 1
NET: Registered protocol family 17
yaffs: dev is 32505858 name is "mtdblock2"
yaffs: Attempting MTD mount on 31.2, "mtdblock2"
block 1371 is bad
VFS: Mounted root (yaffs filesystem).
Mounted devfs on /dev


Even looks doesn't make any trouble with the DSO, I think I need make a JTAG for full backup really soon.

[tinhead]

But another thing bug me know, while checking my boot log, looks my NAND has a bad block. Can you please confirm with me?
...
Even looks doesn't make any trouble with the DSO, I think I need make a JTAG for full backup really soon.

Bad blocks are typical for NAND memory (you will always find some with bad blocks in a full tray of brand new NANDs)
the bootloader and then OS YAFFS driver can handle this (normally).

Backup is always good idea, as long you have no ARM JTAG just use the fwdump v3, it will save
bootloader, root and kernel - that's all you evt. need later.

[project]

Backup is always good idea, as long you have no ARM JTAG just use the fwdump v3, it will save
bootloader, root and kernel - that's all you evt. need later.

Thanks, and I did a v3 backup when you post it, just don't know what are included. I'll make a arm jtag tonight and play around it. I have some hynix 64MBx8bit NAND in hand, will check if I can replace it directly.  

Update: yes it'll works, H-jatag has driver too.

[tinhead]

Update: yes it'll works, H-jatag has driver too.

you will need OOB H-JTAG driver to save/restore OOB blocks too!

you can find NAND-OOB drivers for H-JTAG here

http://www.mikrocontroller.net/topic/163836

The s3c2440 ARM need to be initialized, the right one init is already included in H-JTAG software, just
load in H-Flasher the ..\HFC Examples\S3C2440+K9F1208.hfc
You can disable flash id check too if H-Flasher don't like Hynix with NAND OOB drivers (or change the driver, whcih is simple)

[project]

you will need OOB H-JTAG driver to save/restore OOB blocks too!
you can find NAND-OOB drivers for H-JTAG here
http://www.mikrocontroller.net/topic/163836
The s3c2440 ARM need to be initialized, the right one init is already included in H-JTAG software, just
load in H-Flasher the ..\HFC Examples\S3C2440+K9F1208.hfc
You can disable flash id check too if H-Flasher don't like Hynix with NAND OOB drivers (or change the driver, whcih is simple)

Thanks, I'm reading manual for mini2440 and h-jtag now. looks H-flasher v1.1 can flash s3c2440+k9f1208 and s3c2440+hy27us08121a(which I have now).

Update: After research about NAND bad blocks and OOB, I would not bother replace the chip for now, as most factory will ship NAND flash Chip up to 80 bad blocks for lower price. I checked 1/3 of my stocks, only 1/4 no bad blocks, 1-3 bad blocks are most, very few over 10.  Anyway, I made my LPT-jtag, and order one USB-JTAG, will play it little bit later.

[mirgo]

Tekway

USD 580 and free shipping in this store in mainland China: Store http://www.aliexpress.com/fm-store/312788

(I have also talk in phone with this store man "Mr Pioneer Huang" But I did not buy becouse I find more economy solution (not only one scope))

Scope in this store http://www.aliexpress.com/product-fm/414433064-DHL-Free-Shipping-Tekway-DST1102B-Oscilloscope-2channels-100MHz-1GSa-s-7-TFT-16-digit-color-800-wholesalers.html

I think you can securely order at this seller. I already bought five items from him in the last 3 month. Fast shippment and good communication (english). I also talked to him regarding the chinese frontpanel - He will prepare a new english frontpanel that will be sold with the scopes in the near future. So if you want to mod anyway and don't care about guaranty, just order there...

[pgup62]

hi Mirgo,
Ni shi zhong guo ren ba ? ( Are you chinese ?  )

[RFman]

Thanks all for your help,

Is there any advantage in using a Hantek DSO5102B over a DSO5062B or a DSO5062C (60MHz) when hacking to a DSO5202B (200MHz). Other than the price.

I have now read all the posts in this thread. I don't remember seeing an answer to this question, sorry if there was.

[project]

two things?

one, hope they change on/off switch to top, not in front. As this is light weight DSO, need hold the body to push the switch.

second, mini2440 chinese manual has much more information than english.

[project]

Is there any advantage in using a Hantek DSO5102B over a DSO5062B or a DSO5062C (60MHz) when hacking to a DSO5202B (200MHz). Other than the price.

don't count 5062C in, that one will not work or unknow now, it's 500M sa/s, instead 1G.

The 5062b and 5102b basicly same, just different probes, 60Mhz and 100Mhz(good to 150Mhz). you may not need buy new probes for 200Mhz if you buy 5102b.

And 5062b is less available on the market, even hard to find sometime.

If you don't intend to change the input part resistors, 5102b is cal to 200mhz more closer than 5062b, and not absolutely necessary to do so. And if you are lucky as me, you may get one with 200mhz cal already.

other than these, no big diff.

[RFman]

Thanks project,

Which model has the power switch on the top , I didn't know that Hantek made one with the switch on the top. That wouldn't bother me having the switch on the front, I can just put the other hand on the top of the oscilloscope to stop it moving. but that's a good point.

I was thinking more on the end performance once it has been hacked/converted into a 200MHz oscilloscope.

Interesting, the Chinese manual having more information. Wish I could speak Chinese, I would then be able to read it. Maybe someone will translate it and post it here.

[RFman]

Thanks project,

(1) C Model - OK I won't be getting that model.

(2) Probes - Think I will purchase proper 200MHz probes to ensure that I get maximum bandwidth. Probes are not expensive these days. I can always use the old probes on my old 50MHz Tecktrinic 547 valve oscilloscope. Did you know the Tecktronic was the same price as a new car when purchased many years ago.

(3) Input Resistors - Changing SMD components is not a problem for me.
For best performance: Is it that the input resistors on the DSO5062B should be changed; In the DSO5102B it is best if they are changed. Looks like I've missed the messages with regard to this. Do you know what the message numbers are for this.

(4) Question - The DSO5062B with the input resistors changed and with the hack to change it to 200MHz. Is the performance much the same as if a DSO5102B with input resistors changed and hacked to 200MHz.

(5) Not sure what you mean when you say "cal ready" would you please explain this a bit more.

Thanks for your help.

By The Way, Tinhead, thanks for all the work that you have put in for us, you must have spent many hours doing this.

[nukie]

Tekway


USD 580 and free shipping in this store in mainland China: Store http://www.aliexpress.com/fm-store/312788


(I have also talk in phone with this store man "Mr Pioneer Huang" But I did not buy becouse I find more economy solution (not only one scope))

Scope in this store http://www.aliexpress.com/product-fm/414433064-DHL-Free-Shipping-Tekway-DST1102B-Oscilloscope-2channels-100MHz-1GSa-s-7-TFT-16-digit-color-800-wholesalers.html


In Ali you can also chat with seller and this seller also answer phone if you want check for security. (you ask his phone if you need)
Also you can buy with safe system (seller get money after you get scope - but you send money first...)
This seller write quite good english.

And also you can select with same price Hantek or Tekway (100MHz)
MOQ = 1pcs
price USD580
Shipping = Free by DHL (and I think also to Australia)

Power cord... normal power plug in scope end ... just as nearly all equipment you can buy compatible power cable in your country.
China normal electric is 50Hz 220 - 230Vac. (only what chance is this cable wall end, scope end is always same)

With same price my own opinion is "buy Tekway" mut this is only my opinion.

Also you can use PayPal
There is also Escrow (littlebit more safety) system between you and seller.

Now I hope I posted correctly, this is not an advertisement I don't work for anyone, and hello all this is my first post I am from Melbourne, Australia. Posting my positive experience of sourcing the Tekway from its country of origin.

I want to let you guys know that Mr Pioneer Huang is a genuine and honest seller. He is a MCU programmer himself. I chat with him numerous times regarding the Tekway DSO. He knows his stuff and know them well. He's not like someone who sells some teddy bear, iphone bumper and random items. Today I received my oscilloscope from Mr Huang, and I have also left positive feedback on his aliexpress account. He told me in advance that the scope panel is in Chinese but I couldn't care less as the buttons are in English. The panel can be easily peeled off and I can print one with my printer.

The Tekway arrived within a few days to Australia. Due to his low profit margins(as I understand), Mr Huang had to keep the package as small as possible so he could make some money from the sale. I don't mind as long as it arrive in working condition, I am glad to help him out. This is what I received today from DHL-> Australia Post.



Seems reasonable condition. No major ding.


Standard foam protection.


Tekway branded probes, probably a rebranded probe.


Warranty card(hopefully I don't need it), items check list and software on a stupid small mini 3" CD which some slot-in drives wont be able to read It will probably end up in the bin when you can always download the latest from the interweb. I know this sounds a bit ignorant because not everyone has internet but if you wish to include software, please at least supply in a standard disc.


Good News! No mechanical damage visible. I have seen a lot worse handled package.


For the first time I am happy & excited to see a 3 pin Australian IEC plug. Not that I am short of them( I believe everyone on this forum has plenty lying around) but you can actually tell that the seller did the right thing!


See what I mean? English buttons plus Chinese panel. Maybe someone here with an English panel could scan and upload so that we could print it out? Or even better, learn Chinese, I don't think it's that hard you only need to memorize the top 9 or so buttons the rest are in common positions.


Sweet 7" 800x480! Unfortunately, my phone camera don't have the dynamic range to capture the true beauty of the display.


As mention before, this unit has the extra tiny heatsink mounted on 4 of the IC chips, above and underside of the PCB. It has no fan. I haven't done much to the insides yet, I might measure the max temperatures of the PSU area when I am free.

Okay now I need to go figure out how to change the chinese menu/firmware to English. Or take up Chinese electronics class 

[tinhead]

Actually both Hantek and Tekway are fair enough to send what in stock, so if distributor did ordered 10 x 100MHz and they have only 6 ready but some 200MHz there they will "re-label" these 200MHz models as 100MHz and send it out.
So very often you will get better than ordered, of course with software reduced bw but electrically exact the same as higher modell.

The hardware differences between models (resistors) are very small:
Input resistors (channels and ext trigger)

    200MHz - 22R 0.1%
    100MHz - 33R 0.1%
     60MHz  - 33R 0.1%

Compensation resistors (channels only)

    200MHz - 10R 0.1%
    100MHz - 12R 0.1%
     60MHz  - 12R 0.1%


OpAmp resistors (4 x per channel)

    200MHz - 280R 0.1%
    100MHz - 301R 0.1%
     60MHz  - 365R 0.1%

OpAmp arrays (2 x per channel)

    200MHz - 33R 1%
    100MHz - 39R 1%
     60MHz  - 47R 1%

Trigger stage

    200MHz - 82R 0.1%
    100MHz - 100R 0.1%
     60MHz  - 100R 0.1%

After "200MHz hack" the bandwidth depends on these resistor a bit (and of course a little bit the waveform, see picture below),
true 200MHz hardware is good up to (-3db) ~220MHz, 100MHz hardware up to 200MHz and 60MHz hardware up to ~185MHz.

Of course you can replace them, but only if you have good equipment to recalibrate the compensation
(actually most ppl having good equipment would buy directly the right one model and save time/money indirect).
Most ppl i know can live with ~185MHz (for org. 60MHz models) and 200MHz (org. 100MHZ models)
bandwidth and bit less trigger sensivity arroung 200MHz freq - just because they not extended the bw to measure the amplitude
exact for 195 or 210MHz signals but to measure more accuracte up to 100MHz signals.

Finally it is your choice (don't forget the probe price too).

Attached pics:
- 200MHz vs 100MHz hardware signal respond/waveform compare (blue-200MHz model, white 100MHz model)
- red marked the different resistors

[tinhead]

Mr Huang had to keep the package as small as possible so he could make some money from the sale. I don't mind as long as it arrive in working condition,

yeah, normally there is another one a bit bigger paper box arround the small one, but you ruight as long i did arrived healthy who cares.

See what I mean? English buttons plus Chinese panel. Maybe someone here with an English panel could scan and upload so that we could print it out? Or even better, learn Chinese, I don't think it's that hard you only need to memorize the top 9 or so buttons the rest are in common positions.

http://www.tekwayins.net/pic/1202B.jpg

if not sufficient i can scan my Tekway by chance.

[tinhead]

Hantek DSO5062C

Hey Pascal,

as you have some of these Hantek 500MSs models in stock, any chance to make a picture of the PCB ?
It would be interessting to see what's inside, i did noticed there are some diffs but never had a chance to make a picture of PCB.


@ALL
For most beginners a 500MSs would be good enough anyway, for sure it can't be hacked to 200MHz,
but 60MHz (if someone manage to buy them somewhere, but as i remember Hantek wasn't really interessted to sell them - however Tekway is selling them as DST4062B) can be "extended" to 100MHz bw.

[tinhead]

Okay now I need to go figure out how to change the chinese menu/firmware to English. Or take up Chinese electronics class  

tell me the firmware version, click on red marked button and then F1

[nukie]

I think the firmware version is the second line  2.05.0(100305.0)

Okay now I need to go figure out how to change the chinese menu/firmware to English. Or take up Chinese electronics class  

tell me the firmware version, click on red marked button and then F1

[tinhead]

I think the firmware version is the second line   2.05.0(100305.0)

cool (since no USB hack protection), then just do following :

backup the firmware:
download this:
https://www.eevblog.com/forum/index.php?action=dlattach;topic=1571.0;attach=4899

unzip the *.up file to empty USB stick, insert the stick in fromt usb port, wait 4 sec.,
click utility button (that was the red marked in attached picture),
click F2, click F5 (or whatever will be displayed, i believe the old fw is asking for F6) to confirm.

The backup can take up to 5 minutes.

After it is ready remove the usb stick, reboot DSO and move everything from usb stick to whatever
folder on your PC, you might need it later.


then (if you wish) hack it to 200MHz

download this :

https://www.eevblog.com/forum/index.php?action=dlattach;topic=1571.0;attach=4577

again, unzip the *.up file and do firmware update - this will hack your DSO to 200MHz bw.


then download attached *.up file (THIS IS ONLY FOR TEKWAY DST1202B, don't use it on other DSO models),
that's the latest firmware - and do again firmware update

After all you can change the language in utility, F6, F2 (to switch language).

If you don't wish to hack but need the latest Tekway firmware for your DSO let me know.

EDIT: and yeah, post the results .. it seems that someone else tried this few days ago but never said if it worked Maybe just killed the DSO, heh.

[nukie]

Hello tinhead,

Thank you for the 200Mhz firmware english hack but I am not ready to alter the Mhz of my scope yet because I am still 'evaluating' the unit. I will save the instructions you posted for future reference, I am sure 200Mhz will be useful.

I see you have mention it's for Tekway DST1202B, it should be fine with DST1102B right?
If you need someone as a guinea pig, I don't mind bringing it up to 200Mhz temporary to validate your instructions, I will report back in 8 hours time zZZ.

I sent PM regarding the 100Mhz firmware. Thank you so much for your contributions.

Vincent.

[tinhead]

but I am not ready to alter the Mhz of my scope yet because I am still 'evaluating' the unit.

buuuhhhh !

sure, it is always user choice. Attached the official 2.6.3 for Tekway DST1102B,
so you can update your scope to latest vfw version and add english language.