Hantek - Tekway - DSO hack - get 200MHz bw for free

[Gall]

It depends on the contry you're living in.

I.e., Russian federal law explicitly permits reverse-engineering and modification of hardware and software, "if it is needed to provide proper interaction between components of the system". This generally conflicts with intellectual property laws (i.e., a software crack IS a "modification for proper interaction (between application and underlying OS/hardware)"), so only court can make a final decision.

Chinese law seems to permit anything.

[e-pirate]

Hm-m-m.. Let's ask the question in different way: "Can I or any other person get in trouble with HanTekWay helping other people to hack DSOs"? Basicaly, is HanTekWay is interested in kicking anybodies ass because of this hack?

BTW, HanTekWay seems to break GPL.. That was already with ASUS router and they had to open fw.

[Igor]

I think there are no problems with the law.
We buy the device and not the program.  Changing the hardware device, we lose  manufacturer's warranty.
But this is not a violation of the rights of the manufacturer. Who can deny you install on a new car the nitrogen booster, or ban you install sports shock absorbers?
Modifying the program,you do not infringe the rights of the producer, until you begin to sell the modified software, or use it for other commercial purposes, only if the program is protected by a patent.
I do not think that a program running under Linux, is a separate trademark product.

[e-pirate]

Modification of own DSO not suppose to be a crime, I think. But tinhead made recipe public available. Is that a crime?

[bilko]

He did the manufacturer a big favour and increased their sales and market share. Most people on this board would not have even considered buying this brand if it was not made public here.

[tinhead]

Modification of own DSO not suppose to be a crime, I think.

simple said "of course not", as long there is no conflict with the business (best example is Sony) or laws.
However in case of business conflict the court have to judge, not the manufacturer.
So depends on kind of modification and potential law conflict (if you mod your car to fly instead of drive you will break many laws, not only manufacturer IPs) it might be a crime.

Good example for legal mod is the LAN-Addon card, i even got some support from Hantek for it
(as for the old hardware revision is no LAN addon planed there is no business conflict - for the new hardware revision
this question has been not yet answered) - this means i can even produce and sell such LAN-Addon boards.

But tinhead made recipe public available. Is that a crime?

All i did was to publish a "security hole" which is not illegal and to be very honest i notified HanTekway about it (so they know my name).

A different story is for those who did modified own DSO - in this special case (as you using exact the way the manufacturer is using)
it is a "crime", the 100/200MHz bw are "payable options" so in principle everybody who did such mod should at least
pay the potential price difference to the manufacturer.

It would/could (and this depends on country laws) be a different story if someone would develop hardware/software addon
changing the bw (no, not just a batch file changing something but a real addon).

Currently, due GPL infringement HanTekway can't do anything against these who mod their own DSO (and they will probably never do soemthing, just because it costs much more than the potential revenue - they smart enough to know that this will kill the
business - they not brainless like Sony). In worst case it can happens that if you send back your modified DSO to HanTekway for repair
they will send you an invoice.

However i'm sure HanTekway will kick your ass if you shop-owner/distributor selling modified DSOs or selling the mod itself
or helping (even for free) your customers to use this mod as this is direct business conflict (regardless of GPL or whatever).

[e-pirate]

Got you. So, simplified answer is that if you are not making money of it - you are safe.
As for me, I'm not a "business" at all, I'm a regular hobbyist, even not modified my DSO (but crackopened, as you can see. I'm trying to open almost everything I get in my hands anyway). And frankly speaking, I bought this device only because of review and it's "open" (read "known") architecture.

For now, my questions are:
1. what fs is used for .bin files?
2. what database language files stored in?

[tinhead]

For now, my questions are:
1. what fs is used for .bin files?
2. what database language files stored in?

fs is YAFFS, help file (/help.db) is SQLite format 3 and language files are located in /OurLangauges , they are pure text files.

[e-pirate]

There are two versions of YAFFS: yaffs and yaffs2, so what is the used one?

[tinhead]

There are two versions of YAFFS: yaffs and yaffs2, so what is the used one?

yaffs is yaffs, yaffs2 is yaffs v2 ... it doen not really matter, and as said before YAFFS

[p1ge0n]

Hi everybody,

Thanks for you for helping me choose Hantek DSO1502B which has arrived yesterday. I'm very satisfied with it. Today I had a look inside and found that it has new hardware revision PCB. Is it possible to "upgrade" it to 200Mhz? What about resistors? Thank you in advance for advise.

Regards,
Paul

[tinhead]

Hi everybody,

Thanks for you for helping me choose Hantek DSO1502B which has arrived yesterday. I'm very satisfied with it. Today I had a look inside and found that it has new hardware revision PCB. Is it possible to "upgrade" it to 200Mhz? What about resistors? Thank you in advance for advise.

Regards,
Paul

sure, you can still use the how-to from page 1 of this thread (meaning over uart/shell) or
as you have new firmware anyway (which includes the "special" hole) you can build your own firmware doing the change for you.
So depends on you, if you know how build firmware and you know how to fix in case of disaster (well actually very easy over uart),
then you can build your own fw (note: the one posted by wjb444 is for Tekway not Hantek, but the way how it works is the same).
If you don't know, just go the secure way - over uart.

The resistors - well, i don't know how often i said "do not play with them unless you have good equipment to re-calibrate the DSO",
but unfortunately ppl just soldering around and wondering later why there is 5ns skew or trigger not working ...
On the other side the 5102B you have is good up to 200MHz with these resistors
(if they for 100MHz unit, it can be you got re-labeled 200mhz unit anyway), so no need to fix it anything anyway.

[p1ge0n]

Thanks tinhead for the prompt answer. I'll try to do it over uart. Is it possible to determine what version do I have? The resistors values are different compare to what you published for Tekway PCB. I'm not going to replace them, just curious.

[tinhead]

Thanks tinhead for the prompt answer. I'll try to do it over uart. Is it possible to determine what version do I have? The resistors values are different compare to what you published for Tekway PCB. I'm not going to replace them, just curious.

nice, maybe new/improved combination ? shot a picture of one of the input chanels.

[clonecrp]

e-priest:

Can you send me contact info on your Hantek DSO5102B supplier please...?

Thanks!
Doug

[e-pirate]

e-priest:
Can you send me contact info on your Hantek DSO5102B supplier please...?

I've bought it from AliExpress.com, search for "Hantek DSO-5102B".

[e-pirate]

Thanks tinhead for the prompt answer. I'll try to do it over uart. Is it possible to determine what version do I have? The resistors values are different compare to what you published for Tekway PCB. I'm not going to replace them, just curious.

And it will be nice if you post a photo of power supply to.

[clonecrp]

e-priest:

I see you purchased from them ...

I recently purchased a Hantek DDS-3x25 arbitrary Wave form generator from http://www.thefamousbrandsoutlet.com and find they have also have the Hantek 100MHz 2Channel Digital Storage Oscilloscope DSO5102B with warranty => http://www.thefamousbrandsoutlet.com/test-measurement-instruments/benchtop-oscilloscopes/hantek-100mhz-2channel-digital-storage-oscilloscope-dso5102b.html ,these guys (Frank) are in Toronto but ship from Niagara Falls, NY with free shipping in the US.

How are your progressing on your mod(s) ?

Please advise...

Thanks!
Doug

[e-pirate]

How are your progressing on your mod(s) ?
Please advise...
Thanks!
Doug

Well, my device OK and works fine, but I'm not going to mod it until I at least I will be able to measure the difference. I'm going to build 350 ps rise edge generator. I crack opened it, you can find some photos on pages above, but nothing special, same 1.00.3 Tekway board inside. Dirty soldering, tons of flux.. but still not bad and much better than expected from 6 hundred backs Chinese toy. It's definitely can be hacked, but I have some unanswered questions. Seems that prices go down.

USD 640 not a bad price for device with warranty, but keep in mind, you will void it if you mod/hack. I actually already forget how you guys in USA deal with VAT or whatever, I've been in US very long ago, I was lucky enough to get mine paying no taxes at all.

[clonecrp]

e-priest:

Thanks for the rapid response... Really appreciate the shots ...

I think you are fortunate on the price. No VAT here in the US ... at least not for now.

I use a cleaner called carbo-chlor to clean my PCBs ... not to inhale though ... also IBM made a cleaner that works well too Cleaning Fluid Part No. 450608 with contains similar to carbo-chlor but other stuff too:

1,1,1-Trichoroethane <= That's the stuff that does the trick ! Product says it also may have 1,2-Butylene Oxide, Diethylele Ether,Glycol Methylene, Swc-Butanol, Nitromethane.... but the the "Trich" moves all residue away. 

I don't think the carbo-chlor or IBM Cleaning Fluid are sold in U.S. any longer ... the "Trich" also melts some plastics but I haven't seen the melting problem with many PCB components.

Warmest Regards,

Doug

[e-pirate]

What Volts/Div:Coarse/Fine does in channel menu? A can't figure you what changes between Coarse and Fine.

[rf-loop]

What Volts/Div:Coarse/Fine does in channel menu? A can't figure you what changes between Coarse and Fine.

Normal steps are example 1 - 2 - 5V / div

Select Fine.

Now turn channel voltage adjust knob. (Vertical:  Volts/div)

It changes example 1.02V - 1.04V - 1.06V - 1.08V - 1.10V / div
(steps are different in different voltage "band") example if go under 1V next is 990mV/div  etc.)

[e-pirate]

Normal steps are example 1 - 2 - 5V / div
Select Fine.
Now turn channel voltage adjust knob. (Vertical:  Volts/div)
It changes example 1.02V - 1.04V - 1.06V - 1.08V - 1.10V / div
(steps are different in different voltage "band") example if go under 1V next is 990mV/div  etc.)

Got it, thank you.

[tinhead]

As there is no PSRR data for overclocked ADCs i spend some time
and measured it by myself (PSRR of AD9288 under overclocking condition).
As far i can see the PSRR is only about 25db for 50MHz signals (ADC clock 125MHz)
and only 18db for 200MHz signals (ADC clock 125MHz).

This means, with the measured 18mV PSU ripple (before my mod) the ADC error
is about 1mV with 50MHz and 2.25mV with 200MHz signal which is
in worst case about 1/2 LSB of the AD9288.

So why any mods ? Well, the original design (with overclocked AD9288)
was done by Instek, these guys calculated everything proper, no issue at all.

Tekway's design is working too - on paper at least. In real world
we have not a single ADC but at least 2 physical ADC die's, so in worst case
the error need to be multiplied by 2.

(Instek's original design have better power supply, so still no issue at all for Instek DSOs).

This means with input freq. starting from 150MHz the error is above 1/2LSB
and finally about 1 LSB with 200MHz input signal.

1LSB is maybe not much, but i don't like it, therfore i did modified the PSU a littlebit
to improve a bit 5V / 3.3V supply.


The mod is very simple:
4700/10V instead of C19 (3300/10)
1500/10V instead of C14 (1000/16)
3 x 47/6.3V SMD on the bottom side instead of C22 (330/10)

and DC/DC converter (so the PSU is cold now) instead of KA378R33.


The part numbers are:

2 x EEFCD0J470R (Farnell/Element14 9694714) - that's the 47uF SMD caps soldered on bottom side of PSU pcb.
1 x PTH04070WAH (Farnell/Element14 1470479) - dc/dc converter
2 x GRM32ER71A476KE15L (Farnell/Element14 1797018) - soldered as close as possible to PTH04070 pins

1 x EEUFM1A152L (Farnell/Element14 1855213) - 1500uF
1 x EEUFM1A472L (Farnell/Element14 1219459) - 4700uF


The Ti DC/DC sonverter is recommended for Altera FPGA designs, so it will
definitely work better for fast transient /high load as the KA378R33.

After all i did measured the ripple, it is now about 11mV (instead of 18mV) for the 3.3V
and 61mV (instead of 76mV) for the 5V.

The attached 3.3V ripple measurment is again with digital/analog filter, so you can see only 6mV
Vpp ripple, but on good analog scope it is in real 11mV.

This is maybe not that much, but now in worst case the ADC error is a little bit higher that 1/2LSB.

you can compare to what was before :
https://www.eevblog.com/forum/index.php?topic=1571.msg41294#msg41294

Total price of the mode, something about 16USD.
You can of course do it with combination of TPS73701/TPS7A8001 (to produce clean 3.3V from 5V)
but my goal was to reduce the 5V ripple too and replace the unnecessary "heat-engine" (KA378R33).

[ccatt]

 If Tekway disable the UART port,What can I do?My dso 's UART not transmit any message.Before this,I let after-sales department to handle this so-called update .I don't know is or isn't this(http://www.xici.net/#b1293165/door.asp)
How am I to open the UART port? what to writer the vivi.bin or the original bootloader ,I want knoe the specific address or offset ?