Hantek - Tekway - DSO hack - get 200MHz bw for free

[morris6]

Better check that again.. there are several empty footprints. The H1007 hardware has a 20 pin, 2x 10 pin, 2mm pitch connector for the processor's JTAG. Attached a picture here.

[DC1MC]

Better check that again.. there are several empty footprints. The H1007 hardware has a 20 pin, 2x 10 pin, 2mm pitch connector for the processor's JTAG. Attached a picture here.

Well then I was just reading in the OpenOCD manual, the thing is packaged back, excellent, then if it's a full JTAG then everything should go easier .

[morris6]

From the schematic: the 2x10 pin headers are programming ports for the FPGA and the CPLD.

Attached here a detail of the schematic containing the JTAG header and the reset circuit.

[DC1MC]

From the schematic: the 2x10 pin headers are programming ports for the FPGA and the CPLD.

Attached here a detail of the schematic containing the JTAG header and the reset circuit.

So this header has the CPU in the chain ?

[morris6]

Well, from what I see in my notes the NAND isn't talked to directly by the JTAG. I used the H-TAG program with LPT-port JTAG as mentioned earlier. After connecting to the processor a short program was uploaded in RAM and that made it possible to read and write the Flash memory. Also a script file needed to be filled with some parameters about addresses and clock setup. For now I didn't find any more info on my old W7 disk, the script was probably with the program on an even older XP system.

I suggest that you get your connection to the CPU working first and thereafter see what is needed in your setup to connect to the flash memory.
Easiest is to flash the NAND with an assembled file that contains boot, empty area, kernel and root files with OOB info. That will contain in hex 0x0420.0000 bytes, 131072 pages, 4096 blocks.

For reference, the complete schematics attached here. They were published earlier in this thread and on Mikrocontroller.net. And be aware, this is all the great work of Tinhead who reverse engineered the whole thing.

[DC1MC]

Well, from what I see in my notes the NAND isn't talked to directly by the JTAG. I used the H-TAG program with LPT-port JTAG as mentioned earlier. After connecting to the processor a short program was uploaded in RAM and that made it possible to read and write the Flash memory. Also a script file needed to be filled with some parameters about addresses and clock setup. For now I didn't find any more info on my old W7 disk, the script was probably with the program on an even older XP system.

I suggest that you get your connection to the CPU working first and thereafter see what is needed in your setup to connect to the flash memory.
Easiest is to flash the NAND with an assembled file that contains boot, empty area, kernel and root files with OOB info. That will contain in hex 0x0420.0000 bytes, 131072 pages, 4096 blocks.

For reference, the complete schematics attached here. They were published earlier in this thread and on Mikrocontroller.net. And be aware, this is all the great work of Tinhead who reverse engineered the whole thing.

That was indeed a tremendous effort, @Tinhead if you lurk here anymore, have another thanks. This is why I hesitate to dismantle the device, so much effort was put into reversing and documenting it.

[Dragon1559]

Hello. There is a dso5102p Hunter. When measuring, it hovered. After the reboot, the inscription appears on the screen (Error: the Fpga version does not match the application!!!). It does not respond to pressing the buttons. When exiting to recovery, the buttons don't work either. Please tell me what can be done ? I'm sorry if I don't understand using a translator .

[DC1MC]

So, I've decided to see if the Voltcraft is gonna be a a source for parts/modules or it can be restored, I've seen the pretty strange JTAG restoration procedure with some windozo-chinesian parallel port adapter and strange program and I was wondering if I can't use Linux, OpenOCD and my cheap J-Link V8 clone.
It seems that it is possible, and I'll post here some notes for the Linux users, maybe someone we'll find them useful to restore/hack his device. this micro-tutorial assumes that the user is a bit familiar with compiling programs from source under Linux and running a couple of simple command line commands.
If anyone needs details I'll be happy to oblige, but I don't want to make this too complicated:

- From the hardwaffe point of view, the biggest hurdle is to extract the mainboard without damaging the ribbon cables for the screen and front panel and solder some wires on the JTAG connector, or, if you have OCD, find a 2mm pitch 2x10pin dual row connector, then build a cable with an adapter for the 20pin 2.54mm of the JTAG adapter, I don't have OCD, so I just cut some cheap Dupont male cables in half and soldered the wires directly, in the picture one can see how they were stick in the 20pin connector of the cable that comes with the J-Link clone, just in case it may be useful for somebody with the same adapter here are the colors and the signals:

Code: [Select]

GND- Black
nTRST - Brown
VTRef - Republicans
TDI - Trump
TMS - Yellow
TCK - Greta
TDO - Democrats
nRST - Purple rain

- First softwaffe things first, get the latest OpenOCD sources (clone the master repository), compile and install it, a simplified list of commands will be:

Code: [Select]

git clone https://git.code.sf.net/p/openocd/code openocd-code
cd openocd-code
sudo apt install libftdi-dev libftdi1-dev libhidapi-dev
#(these were the development libraries that I was missing, if you have others not installed, configure will stop and indicate what is missing)
./boostrap
./configure --enable-jlink --enable-usb-blaster --enable-stlink --enable-doxygen-pdf --enable-usbprog  --enable-openjtag  --enable-cmsis-dap --enable-cmsis-dap-v2 --enable-usb-blaster-2  --enable-ulink    --enable-ftdi
# (these are all the JTAG adapters that I already have or plan to get in the future).
# At the end of the configure script, if you used the same parameters, you should get:
OpenOCD configuration summary
--------------------------------------------------
MPSSE mode of FTDI based devices        yes
ST-Link Programmer                      yes
TI ICDI JTAG Programmer                 yes (auto)
Keil ULINK JTAG Programmer              yes
Altera USB-Blaster II Compatible        yes
Bitbang mode of FT232R based devices    yes (auto)
Versaloon-Link JTAG Programmer          yes (auto)
TI XDS110 Debug Probe                   yes (auto)
CMSIS-DAP v2 Compliant Debugger         yes
OSBDM (JTAG only) Programmer            yes (auto)
eStick/opendous JTAG Programmer         yes (auto)
Olimex ARM-JTAG-EW Programmer           yes (auto)
Raisonance RLink JTAG Programmer        yes (auto)
USBProg JTAG Programmer                 yes
Andes JTAG Programmer                   yes (auto)
CMSIS-DAP Compliant Debugger            yes
Nu-Link Programmer                      yes (auto)
Cypress KitProg Programmer              yes (auto)
Altera USB-Blaster Compatible           yes
ASIX Presto Adapter                     yes (auto)
OpenJTAG Adapter                        yes
Linux GPIO bitbang through libgpiod     no
SEGGER J-Link Programmer                yes
Bus Pirate                              yes (auto)
Use Capstone disassembly framework      no
#(The last command will install the new openocd in the /usr/local/bin)
make && sudo make install

Once the fresh openocd is installed, one needs a configuration file for the board, fortunately there is already one available, that is attached to this message, it has the right SoC and the right flash so you don't have to do anything  .
The next configuration file that is needed it the one for the JTAG adapter, I'm using a cheap (12EUR) J-Link clone (observe picture). IMMV, then you have to use the suitable configuration file for your adapter.

Finally launch the OpenOCD server:

Code: [Select]

openocd -f interface/jlink.cfg -f target/voltcraft_dso-3062c.cfg
Open On-Chip Debugger 0.11.0+dev-00463-ga498a3dea (2021-11-14-12:31)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Info : J-Link V9 compiled May  7 2021 16:26:12
Info : Hardware version: 9.70
Info : VTarget = 3.279 V
Info : Reduced speed from 16000 kHz to 15000 kHz (maximum)
Info : Reduced speed from 16000 kHz to 15000 kHz (maximum)
Info : clock speed 16000 kHz
Info : JTAG tap: s3c2440.cpu tap/device found: 0x0032409d (mfg: 0x04e (Samsung), part: 0x0324, ver: 0x0)
Info : Embedded ICE version 2
Info : s3c2440.cpu: hardware has 2 breakpoint/watchpoint units
Info : starting gdb server for s3c2440.cpu on 3333
Info : Listening on port 3333 for gdb connections
[b]Info : JTAG tap: s3c2440.cpu tap/device found: 0x0032409d (mfg: 0x04e (Samsung), part: 0x0324, ver: 0x0)[/b]
Warn : NOTE! DCC downloads have not been enabled, defaulting to slow memory writes. Type 'help dcc'.
Warn : NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
target halted in ARM state due to debug-request, current mode: Undefined instruction
cpsr: 0x800000db pc: 0x33d801c4
MMU: disabled, D-Cache: disabled, I-Cache: enabled
[b]#0: NAND 64MiB 3.3V 8-bit (Samsung) pagesize: 512, buswidth: 8,
blocksize: 16384, blocks: 4096
[/b]
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : accepting 'telnet' connection on tcp/4444
(it will stay here waiting to be killed, but I keep it in the foreground to see what is printed and do the telnet in another terminal window)

As you can see the SoC and the flash are recognized immediately, so install your telnet program and connect by doing:

telnet localhost 4444

You should get back something like:

Code: [Select]

telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger

One can try some commands to probe the NAND again::

Code: [Select]

> nand probe 0
NAND flash device 'NAND 64MiB 3.3V 8-bit (Samsung)' found

In an attempt to change the the programming speed from glacial to extremely slow     I've used their advice and enable the fast memory access:

Code: [Select]

s3c2440.cpu arm7_9 fast_memory_access enable
I don't think that it increased the speed too much, but just for completion.


###### !!!!!!!!!  WARNING, FROM HERE ON IS THE POINT OF NO RETURN, YOUR SCOPE WILL BE BRICKED AND MAY OR NOT COME BACK  !!!!!!!!!! #############
###### !!!!!!!!!  DO YOU HAVE YOUR FULL FIRMWARE BACKUP WITH OOB, IF NOT STOP NOW  !!!!!!!!!! #############



So let's irreversible ERASE THE NAND:

Code: [Select]

> nand erase 0
s3c2440_read_block_data: reading data: 0x5569077b5730, 0x7fff3c3a61e2, 6
s3c2440_read_block_data: reading data: 0x5569077b5730, 0x7fff3c3a61e2, 6
... a MILLION of these lines will scroll, and scroll, and scroll, for ca. 5 min   :palm:
... and then, suddeny:
erased blocks 0 to 4095 on NAND flash device #0 'NAND 64MiB 3.3V 8-bit'

Then is time to program your full firmware backup with OOB data:

Code: [Select]

> nand write 0 fw_backup.bin 0 oob_raw

And here we stop for the moment, because after two hours, the operation didn't completed yet  , when/if will complete I'll update the post, but I have high hopes that will be done, as opposed with the erase operation the write is completely mute and doesn't produce any message on the console, but the good thing is that there are also no error messages  .

EDIT: IT WORKS !!!

At the GLORIOUS speed of 1.509 KiB/s  !!!

But at least it runs now happily (it does fail the self-calibration with the files included in the donated firmware, but this thread provides EVERYTHING !!!, including how to redo the factory calibration  )

So yeah, I've now seen what produced the original issue, the previous owner seem to have installed the update available on the Voltcraft site, that bricks the <15000 series device and this is a 11xxx, and the update even has a BIG WARNING file, but I guess is hopeless for some, egal what warning one includes.

In any case, the logo made with the logo editor from this thread can be both put in the Linux partition and the  resulted .ebm file can be put in the logo flash partition as well, because this was screwed-up as well.

The only sad part is the sad condition of the well known programmers with OpenOCD, it's ridiculous to have complex programmable state machines and just use them for bit banging, via a gorrilion layers of abstraction, no wonder that the parallel port adapter works much better , but I guess it is how it is.

Now I can finally assist newbies like I was with everything  .

Cheers,
DC1MC

Cheers,
DC1MC

[DC1MC]

Hello. There is a dso5102p Hunter. When measuring, it hovered. After the reboot, the inscription appears on the screen (Error: the Fpga version does not match the application!!!). It does not respond to pressing the buttons. When exiting to recovery, the buttons don't work either. Please tell me what can be done ? I'm sorry if I don't understand using a translator .

Hi, don't worry, if it died because of the NAND corruption, it can be saved. In the worst case, you'll need to replace the NAND chip, is annoying, but not very bad, because is TSOP not BGA. You need to connect to the serial port and tell us what is saying on the console, if you have a firmware backup maybe is still possible to update using linux, and you won't need to get a JTAG adapter, but fortunately they are not expensive.
Of course if the FPGA has died, then is gone, but I never heard of such a defect.

DC1MC

[morris6]

And here we stop for the moment, because after two hours, the operation didn't completed yet  , when/if will complete I'll update the post, but I have high hopes that will be done, as opposed with the erase operation the write is completely mute and doesn't produce any message on the console, but the good thing is that there are also no error messages  .

EDIT: IT WORKS !!!

It took some time, I must say I waited with fingers crossed during this cliffhanger...!

Well, at least the backup I made in April 2013 served a purpose after all.

Have fun,
Morris6

[DC1MC]

And here we stop for the moment, because after two hours, the operation didn't completed yet  , when/if will complete I'll update the post, but I have high hopes that will be done, as opposed with the erase operation the write is completely mute and doesn't produce any message on the console, but the good thing is that there are also no error messages  .

EDIT: IT WORKS !!!

It took some time, I must say I waited with fingers crossed during this cliffhanger...!

Well, at least the backup I made in April 2013 served a purpose after all.

Have fun,
Morris6

Thank you again my good man, besides the factory calibration that anyway had to be re-done after 200MHz update and there is already a nice detailed procedure, all seem to work, I'll give it to my friend and let him deal with it, I've had a look at the board and wondered why I can't see the place for magnetics and Ethernet PHY, well is because is a serial port only !!!, of course, the optical isolators and their resistors are not mounted as well, but for the moment I don't care, if my friend will want to solder them I'll help. But this did show me that OpenOCD is in a sad state as it was in 2016 and I didn't had any 32-bit windows machine, now I have, even if it didn't prove too useful (still no LPT).

I was wondering, did you attempt to upgrade the FW to the latest from @tinhead google drive, it seems that there is a 2.07 from 2014 ?, I will attempt to install it when the cold will let me live again.
Also, stupid question, how one does access the logic analyzer menu, the cable octopus must be already inserted to work or how is done, in which chinesian menu is buried, Acquire ?

Cheers,
DC1MC

[morris6]

The picture in your message #3162, Jlink.jpg, shows the daughter board. Near the connector to the motherboard is a footprint JC1. That's for the magnetics. The dm9000 ethernet chip is on the bottom side of the daughter board if I remember correctly. the RJ45 plug is on the main board, J2 just visible in your picture near the ribbon cable connector for your Jtag setup.

The logic analyzer menu is reached with the F7 button. A push rotates between zoom, LA, and normal.

FWIW, the latest usable firmware for this thing is version is 2.7.01 date 140815.

[DC1MC]

Heh, thanks again man, I never thought to look at the daughter board I thought is the LA add-on for the MSO only, the RJ45 connector footprint was easy to spot, but looking around I've only seen the optical isolators under. Do know by chance the  order code for the compatible magnetics ? I may be arsed to remove the mainboard again to solder the stuff or I'll try to see if it sees a cheap USB-Ethernet adapter on the front USB, hey if the antique kernel sees an USB hub with a memory stick AND an USB Network adapter I think is the best setup possible.

Bloody F7 huh, fully unlabeled 

EDIT: Also, searching for a fast OpenOCD compatible JTAG adapter turned out a post from me in 2018 when I was complaining that the USB Blaster from Altera under OpenOCD just yields 7KiB on the "obscure" iMX28 SoC, the things definitely didn't improved in the meantime, au cotraire.

[morris6]

@DC1MC: Maybe have a look at the schematic. The last page has the option LAN info. Transformer is a H1102NL, looks not too difficult to score one. But once again, the network functionality is restricted as far as I remember. The Linux driver and adaptation was done by Tinhead cs. I'm not sure the adaptation is in the mainstream firmware. It has never been a factory supported option, as far as I know. So no integration in the software further, no webpage or SCPI. Only Telnet on a fixed IP??

The user manual for the thing is still available it seems, from Hantek: http://www.hantek.com/Product/MSO5000D/MSO5000D_Manual.pdf

Have fun with all the bugs this thing has, in my view it was never a completed product.
Morris6

[DC1MC]

@DC1MC: Maybe have a look at the schematic. The last page has the option LAN info. Transformer is a H1102NL, looks not too difficult to score one. But once again, the network functionality is restricted as far as I remember. The Linux driver and adaptation was done by Tinhead cs. I'm not sure the adaptation is in the mainstream firmware. It has never been a factory supported option, as far as I know. So no integration in the software further, no webpage or SCPI. Only Telnet on a fixed IP??

The user manual for the thing is still available it seems, from Hantek: http://www.hantek.com/Product/MSO5000D/MSO5000D_Manual.pdf

Have fun with all the bugs this thing has, in my view it was never a completed product.
Morris6

Is not for me is for a friend that is a scientist and is happy that he'll be able to relatively easy run some special apps on it. I had enough on my hands with a Rigol MSO.
How after renaming and editing the files, it appears in the System Status as "MSO5202B" but the time base goes only to 4ns/div and not to 2ns/div, even with just one channel enabled  , do I need to modify the EEPROM as well, or I'm doing something wrong.
This should be the last thing to do before I'll close it and send it to its destiny .

 Cheers,
 DC1MC

[morris6]

Well, the hack is supposed to work, also for the MSO5062B. It is indeed working for the thing I have here. So maybe start again at page 1 of this thread?

[Dragon1559]

You need to connect to the serial port and tell us what is saying on the console, if you have a firmware backup maybe is still possible to update using linux, and you won't need to get a JTAG adapter, but fortunately they are not expensive.

DC1MC
[/quote]
Sorry confused how to answer. Is that what you wanted ?

[DC1MC]

Well, the hack is supposed to work, also for the MSO5062B. It is indeed working for the thing I have here. So maybe start again at page 1 of this thread?

After updating the fw with the latest from @tinhead Google drive, everything woks OK, the device was re-calibrated, re-assembled and delivered to its owner, waiting for the feed-back, thanks for all the help, both you, @tinhead and al the other people that made it possible  .

 Cheers,
 DC1MC

[Spectrum]

Hi, I have an Hantek DSO 8072E V1 0.1 an Handheld Scope with DMM, Bandwith 70 Mhz. There is also the 8102E / 8152E / 8202E, version 100/150/200 MHz. Now you can only buy the 200 MHz version, so I wondered if it is possible to have an upgrade from 70 to 200 MHz. Do you think it is possible ?

Thanks for help and answers.

[Gcs190]

Yes, without any problem, I did so, check my messages in this thread, it is very easy.

[Spectrum]

Yes, without any problem, I did so, check my messages in this thread, it is very easy.

Thank you for the answer, in which page you wrote this ? I do not see my model (Hantek DSO 8072E) in neither messages

[tonyalbus]

In 2022 the hack on the DSO5072P is still working and you can just upgrade the firmware after from the official website, the firmware update is for the whole 5000P Series so no problem which to pick.
One thing i doubt still, is the backup.. i have read now all this tread and the main links go to a backup tool with 4 files, while some now mention a backup with 8 partitions.
Can someone link to the 8 partition backup that is verified working for the DSO5072P ?

Here is a video of my process step by step with test on bandwith and risetime, before and after.

Yes it still can be done in 2022 without opening.. Thanks to a lot of people here. Thanks All

[jasom]

is that hack working also for DSO5102B?

[soesante]

Tried to find the full nand backup for dso5072p everywhere in the forum but no luck.. would be much appreciate if anyone willing to share their full backup of dso5072p.. my dso5072p firmware is corrupted.. and stuck in the boot logo screen. And  would try to fix the firmware with all the guideline available in this forum..

[chinoy]

Yes from what I have read it should.
Only confusion I have is that in some videos people are updating the firmware post hack to the 5102B firmware. Saw it on a few videos.
And if we convert it to 200 Mhz. Why are we updating with the older 100 Mhz firmware.
Also it would be nice if one of the wizards like tinman. Could figure out a way to do SPI on this scope.

Ps: I am still stuck on step 1 create back. The complete confusion about 4 file dump and 8 file dump.

This is taken from the latest backup tool.
Note - the backup is creating dump of all/specified mtd partitions with following params:
- When 'oob.txt' file exists a dump with OOB will be created. File 'omitoob.txt' is opposite option.
- When 'dumpbad.txt' file exists a dump with bad PEBs will be created. File 'omitbad.txt' is opposite option.
- When 'mtd.txt' file exists a 'grep -f mtd.txt' will be used as filter for /proc/mtd output. When it is missing, all MTD partition found in /proc/mtd will be dumped.

(The above has me totally confused. Maybe I just need to catch up on some sleep).

is that hack working also for DSO5102B?

I started to read this post from page 1. Only reached page 50.
I got my scope on flipkart for 170$ USD.
It was delivered. And it works. It came with 200 Mhz Probes. Says 80/100/150/200
Here is a picture showing serial number, firmware etc.
My only objective right now is to backup my firmware.
I have a USB to UART because its used on a few of my products.
The seller vanished. Cant contact. Was finally able to register my product on the hantek site. 
We have a few guys selling these sopes here all claim to be official dealers which is funny.

https://drive.google.com/file/d/15Pm-G6RVFpDAAb4ZEi4SiN4tTDGaiS8v/view?usp=sharing

Grab this file fast if you cant boot its only up for another 4 days.
This is for 5102P sold in 2022. i.e. serial number is very close to mine. And it has been provided on the hantek support forum. The file will vanish in 4 days. Before providing this link he asked for his serial number. Not sure what the implications are of that. In case you cant boot this file will restore your scope it has 4 files inside it. kernel.bin/rootfs.ubi/recover_burn_dso_nocfg_200917.up (I fear this might be in Chinese). I will ask for the same using my serial number. Mine is english.
https://www.filemail.com/d/zodmkhvophkuyrm