Hantek - Tekway - DSO hack - get 200MHz bw for free - Page 1
Forum section: electronics / testgear

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 05:01:32 am
content: The topic is about how to hack another one Chinese DSO (Tekway/Hantek) up to 200MHz bandwidth.-short historyWhen my Tek TDS754D died some time ago i had to find a replacement. At that time (2009) I ordered fewcheap known china DSOs and tested them in detail:- UNI-T (UT2102CE)- Rigol (DS1102E)- Atten (ADS1102CE)- Tekway (DST1102B)Finally i decided to take Tekway DST1102B instead of Rigol DS1102E because :(ATTEN and UNI-T was at that time simply useless crap)- 7" high quality display (Innolux AT070TN83 V1) with 800 x 480 resolution- display viewing angle designed for "on a shelf above the workbench" use- DPO-like functionality- 2500 wfrms/s update rate- Linux OS on good known Samsung ARM S3C2440 SoC- modern firmware with lot of unique (in the <1k USD DSO price class) featuresTekway call these model "Tekway DSO 2.0 Platform", and yes, there was "DSO 1.0 Platform" in 2008-2009http://www.tekwayins.com/product.asp?ArticleID=7but that completely different gear (with 2.5k memory depth, 320x240 display resolution and TEK TDS2000 like firmware)In the meantime there are as well Hantek DSOs/Handhelds using that Tekway DSO 2.0 platform, as well some rebadgedmodels (some made by Tekway, other by Hantek) from Extech, PCE, Voltcraft, Protek, ICEL, AKIP, Redsea, Zhongce, etc !!!-what inside Tekway/Hanteki have reverse-engineered the hardware and made schematics:-hw0 (produced from Dec 2009 to Feb 2011)readyhttps://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg56754/#msg56754-hw1005 (produced from Feb 2011 to Jun 2011)readyerrata in work-hw1007 (produced Jun 2011 to xxx 2013 , DSOs and MSOs with S/N < 15000)readyhttps://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg214613/#msg214613-handheld hw1001 (S/N < 15000)in work-DSO5xxxP hw1.0on to do listI've made alrady schematics of the new input circuit:https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg264085/#msg264085-before you hack made a backup - if you wishIt make sense to make backup of whole NAND flash (firmware+setting) before any hack attempt.I have prepared easy to use "firmware update" files, simply choose your model, download the tooland read the included Readme.txt to proceed.For all following "B" model benchtop DSO with S/N < 15000- Tekway DST1062B, DST1102B, DST1202B- Hantek DSO5062B, DSO5102B, DSO5202B- Voltcraft DSO-3062C, DSO-1062D- Zhongce DF1202CL, DF1102CL, DF1062CL- Protek 3006, 3010, 3110, 3120https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg35683/#msg35683For all following "BM/BMV" models benchtop DSO with S/N < 15000- Hantek DSO5062BM, DSO5102BM, DSO5202BM- Hantek DSO5062BMV, DSO5102BMV, DSO5202BMVhttps://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg111917/For all following "B" and "D" models benchtop MSO with S/N < 15000- Tekway MST1062B, MST1102B, MST1202B- Hantek MSO5062D, MSO5102D, MSO5202D- Voltcraft MSO5062B, MSO5102Bhttps://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg185074/#msg185074For all following "B", "BV" and "S" models handheld DSO with S/N < 15000- Hantek DSO1062B, DSO1102B, DSO1202B- Hantek DSO1062BV, DSO1102BV, DSO1202BV- Hantek DSO1062S, DSO1122S, DSO1152S- Extech MS6060, MS6100, MS6200https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg86825/#msg86825For all following "P" models benchtop DSO with ANY S/N- Hantek DSO5072P, DSO5102P, DSO5202P- Falcon DSO100C1G (this onehttp://falconindia.biz/products_desc2.aspx?id=120)https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg264194/#msg264194For the cute old Tekway DST1000/DST3000/DST4000 please PM me.For all others (not listed above) DSO/MSO/Handhelds (e.g. with S/N > 15000) please use integrated command line tool "nanddump", do a search in thread to check how that might work.When you need to restore previously created backup, check the Readme.txt from backup tools above and/or following links:https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg75015/#msg75015http://www.mikrocontroller.net/articles/Tekway_MSO-the bandwidth hackAs far i know, all DSO/MSO/Handhelds since 2009 (so yes, even the latest "P" models) can be hacked.To hack the bandwidth all you need to do is to rename one file in DSO root directory- when you have 60MHz/70MHz model (no matter if benchtop or handheld) you must rename /dst1062b to /dst1202b- when you have 100MHz model (no matter if benchtop or handheld) you must rename /dst1102b to /dst1202b- when you have 150MHz model (no matter if benchtop or handheld) you must rename /dst1152b to /dst1202bthen after second reboot (yes, you have to reboot twice) the new bandwidth (and when you decided to goup to 200MHz bandwidth the 2ns/DIV timbase as well) will be available.To do this you can use that tool (then simply choose what bandwidth you wish and click on "Change bandwidth")https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg91877/or that tool (then go to "Shell F2" tab and execute there for example "mv /dst1062b /dst1202b")http://peter.dreisiebner.at/dso-usb-tool/or you can connect via UART to DSOs Linux shell and work from there. You will of course need to open the enclosureand connect to PC via UART to USB converter (e.g. ebay CP2102 UART to USB etc). For the UART pinout check pictures below.-optional - the bootlogo hackyou might wish to change the boot screen logo as well (not necessary for bandwidth hack).For all following "B" model benchtop DSO with S/N < 15000- Tekway DST1062B, DST1102B, DST1202B- Hantek DSO5062B, DSO5102B, DSO5202B- Voltcraft DSO1062D, DSO3062C- Zhongce DF1202CL, DF1102CL, DF1062CL(i don't have logos from Zhongce)Download, when missing, all the boot logoshttp://www.mikrocontroller.net/attachment/136103/all_logos.zipand copy to yor DSOs /logo directoryYou will have as well to edit /logotype and /logotype.dis files. The best is to use "vi" editor on the DSO shell,you might as well copy these two file to PC and edit there. All you need is to change the DSO name fromwhat it is to what you wish to see, e.g. for Hantek DSO5062B you need to change in /logotype the dst1062b to dst1202band in /logotype.dis the hantek_DSO5062B to hantek_DSO5202B.If you have questions - use search, or ask in this thread.For all other following benchtop and handheld models with S/N < 15000- Hantek Handheld DSO1062B/BV, DSO1102B/BV, DSO1202B/BV- Hantek Handheld DSO1062S, DSO1102S, DSO1152S- Tekway MSO MST1062B, MST1102B, MST1202B- Hantek MSO MSO5062D, MSO5102D, MSO5202D- Voltcraft MSO MSO5062D, MSO5102D, MSO5202D- Hantek DSO DSO5062BV/BMV, DSO5102BV/BMV, DSO5202BV/BMV- Extech MS6060, MS6100, MS6200you have to edit a specific execuatable (as the logo is compiled into it), all necessary tools are here:https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg200040/#msg200040For all other following benchtop and handheld models with S/N > 15000 (exept "P" models, they can have ANY S/N)- Hantek DSO5072P, DSO5102P, DSO5202P- Hantek MSO5074F, MSO5074FG- Tekway/Hantek MSO7000B series- Tekway/Hantek DSO/Handheld/MSO with S/N > 15000 and hw1.0 or hw1.10 (so all with S3C2416 SoC)All i can tell for now is that the boot logo seems to be compiled into display driver-optional - frontend hack (models with SN < 15000)It seem that since some time Hantek/Tekway/Voltcraft is using not that great combination of resistors in frontend, it was nearly perfect originaly but they changed it to what is today. Saving everywhere (or for reason to gie all hackers bad respons?) ^^No matter, we can fix it easily, for more information and lot of measurment results seehttps://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg212054/#msg212054-optional - EEPROM licensing hacksometimes one need or wish to enable some extra things, like LAN, more memory, video, etc. The licensing for these functions is stored in EEPROM, see here how to make use of them:https://www.eevblog.com/forum/testgear/hantek-tekway-dso-hack-get-200mhz-bw-for-free/msg467313/#msg467313-bug listsee attached - note, this list is not up to date,ihave towork on it :\-SDK, LabView, other hardware hacks, tons of other thingssimply check the post below-Hantek's OneDrivehttps://onedrive.live.com/?#cid=6C60A056648D9011-and finally my OneDrive with hacks, firmwares, tools, etc:my 1drive share .. PM me if does not work for youIf you like what there and wish to support me/my hacks, then feel free to donate,there is PayPal "donate button" when you click on my "home website" icon @ my eevblog forum profile.

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 05:03:32 am
content: :ALL OTHER HACKS and INFOS:If you wish to connect to the UART, check attached picturesall other hacks temp removed ... in last 4yrs there was so much said, hacked and released that one can easily get lost. Wht i'm doing now is to sort all that knownledge, and split into models/hw version sections. All that information will be the posten here and of course on my OneDrive (see above post for link).

author: Hypernova
author_rank: Unknown
timestamp: October 24, 2010, 07:48:11 am
content: Nifty, you would think the other vendors have learned a thing or two after the rigol incident.

author: cybergibbons
author_rank: Frequent Contributor
timestamp: October 24, 2010, 09:44:46 am
content: Thanks - that's really interesting.As far as I know, both the GW-Instek and Rigol scopes deal with all of the display logic in the FPGA, so have quite limited ability. The UI on these scopes looks a lot more fancy.

author: saturation
author_rank: Super Contributor
timestamp: October 24, 2010, 10:48:54 am
content: Awesome job, tinman and welcome the eevblog, what a great way to start.Don't know much about tekway, but now its worth looking in to.

author: saturation
author_rank: Super Contributor
timestamp: October 24, 2010, 11:11:27 am
content: I have a sneaking suspicion letting the hack info continue and not be suppressed is actually good for business.Consider:If sales of the Rigol 1052E double, it would compensate for each single lost sale of the 1102EBut If the 1102E is really just a factory hacked 1052E, then the manufacturing cost to make either scopes is equal, so they are not losing any sales at all, just making more. The excess inventory of 1102E can always have their case stickers changed and firmware reburned to downgrade them into 1052E. So the only cost to make an 1102E over a 1052E is labor to do the firmware and casing decal changes.If the owner bricks his scope and asks for factory repair, the unit is not under warranty, and now not only did they make a sale on a scope, they can charge for repairRigol now has a bigger reputation, free publicity, more people own it, know its electronics intimately and thus have a better appreciation of its capabilities, and will consider buying their other products now tooSo, its a win win.If you look at the trends in electronics, there is a market of makers and hackers so manufacturers are addressing their wants. Hakko's new iron, the FX888, Agilent's DMM skins, Hakko 936 skins etc., certainly isn't directed towards professional electronics.Which prompted Fluke to make this ad:http://register.fluke.com/globalforms/goyellow/index.htmlQuote from: Hypernova on October 24, 2010, 07:48:11 am

author: Hypernova
author_rank: Unknown
timestamp: October 24, 2010, 12:10:42 pm
content: Quote from: saturation on October 24, 2010, 11:11:27 amWell, that certainly reminds me of the conspiracy theory that Microsoft was loose on copy protection in the early years to ensure that they get the market share in first.

author: PsI-On
author_rank: Contributor
timestamp: October 24, 2010, 01:08:38 pm
content: Hi tinman,Can you post some more pictures please?Looks like I'll be picking one of these up in China next month ;o)Thanks.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 24, 2010, 01:28:34 pm
content: cant find it in ebay, just the 200MHz version. maybe they are pulling all 100MHz back to upgrade to 2.04.SP1 FW?just speculation, not related to anyone who is still live or dead.

author: PsI-On
author_rank: Contributor
timestamp: October 24, 2010, 01:42:51 pm
content: They're listed onwww.taobao.comBe warned, checking prices on taobao.com will leave you feeling sick every time!-P

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 02:00:56 pm
content: Quote from: shafri on October 24, 2010, 01:28:34 pma month ago electrolab.com had some 100MHz versions. It can have something to do with the rumoured Hantek/Tekway deal,but it can be just whatever. The distributor in Germany have still enough in stock, and of course taobao is full of sellers anyway.Quote from: Hypernova on October 24, 2010, 07:48:11 amWell, there are many competitors on low cost DSO market. That why probably every company have to reduce the costs.You can hack almost all low cost DSOs, the question for me was only "which SOC/µC inside, which OS".With Samsung S3C2440 and Linux 2.6.13 was easy thing, much easier than with TI DSP or pure FPGA based DSOs.

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 02:15:54 pm
content: Quote from: shafri on October 24, 2010, 01:28:34 pmi don't think that they will every try. By design the DSO is using these few config files, as this is Linux these can be always changed.Of course Tekway/Hantek can try to disable UART port, JTAG can't be disabled. But even if, you will be still able to make backupof the firmware via JTAG, to "patch" it on your mini2440 board and to restore it back to DSO.The only chance is to change the PCB (the low pass filter around AD8370), which costs more money.EDIT: Actually there are some differences between model, however a hacked 60Mhz DSO can be still good up to 180MHz (-3db)which is i think good value.

author: slburris
author_rank: Frequent Contributor
timestamp: October 24, 2010, 02:24:41 pm
content: Any idea if Tekway makes Hantek's handheld oscilloscopes too?Do you know if the Hantek DSO-1060 could be modified to bea DSO-1200? This would change a 60Mhz scope into a 200Mhz scope.Great information, I bet there's going to be tons of discussionabout this topic!Scott

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 02:27:59 pm
content: Quote from: PsI-On on October 24, 2010, 01:08:38 pmsure, some PCB pics attached. As you can see the PCB is very nice routed, these guys did good jobFor the outside pics check the tekway/hantek websites.Btw, the DSO is fanless, which is good.

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 02:33:29 pm
content: Quote from: slburris on October 24, 2010, 02:24:41 pmthe other Hantek DSOs are made by Hantek itself (or others), but definitely not by Tekway.Tekway started to made DSOs 3years ago and they never had handheld based devices.

author: slburris
author_rank: Frequent Contributor
timestamp: October 24, 2010, 02:34:55 pm
content: I've posted a pointer to this thread over at RCGroups site.Scott

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 24, 2010, 02:53:24 pm
content: whats with the blank capacitor? top left near the samsung? 4th picture

author: PsI-On
author_rank: Contributor
timestamp: October 24, 2010, 03:10:37 pm
content: Looks like it's probably some sort of sounder, I can see what might be a transistor drive circuit feeding off the negative pin!Maybe battery backup?!

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 03:18:55 pm
content: Quote from: shafri on October 24, 2010, 02:53:24 pmThat's where the buzzer was soldered. During debuging the uncofigured Samsung SOC was making me crazy(driving the buzzer high), so i removed it.

author: PsI-On
author_rank: Contributor
timestamp: October 24, 2010, 03:34:41 pm
content: I wonder if you can redirect the terminal session to the 7" LCD and use a USB keyboard (that would make an awesome hackable scope)

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 05:15:55 pm
content: Quote from: PsI-On on October 24, 2010, 03:34:41 pmThe DSO is like a friendlyarm 2440 board, with FPGA and ADC connected via I/O.Afaik you will have to recompile the 2.6.13 kernel to redirect terminal session to the TFT.So in principle yes, with recompiled kernel you can redirect the terminal to TFT, use a usb keyboard(or on screen like xvkbd with touch screen if you connect one) and if you need the DSO functionalityyou have only to start the DSO app from the shell (/dso.exe). Of course the /dso.exe line in rcSneed to be commented out.

author: tinhead
author_rank: Super Contributor
timestamp: October 24, 2010, 05:26:06 pm
content: attached fast rise time 10MHz (1ns rise time) test signal measurement.It is not really perfect example just because the 50Ohm terminationand cable loss, but already 1.8ns which give you an idea what's possible.

author: PsI-On
author_rank: Contributor
timestamp: October 25, 2010, 11:03:09 am
content: Tinman, have you tried this hack on the DST1062B?Do you know if the DST1062B has the same components as the DST1102B?Thanks.

author: ngkee22
author_rank: Regular Contributor
timestamp: October 25, 2010, 02:11:27 pm
content: I did find this one for sale, but it is already at 200Mhz.http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=270568563296&ssPageName=STRK:MEWAX:IT

author: tinhead
author_rank: Super Contributor
timestamp: October 25, 2010, 03:56:12 pm
content: Quote from: ngkee22 on October 25, 2010, 02:11:27 pmyes, right now "Electrolab" have only 200MHz, but they had 100MHz during last months, e.g.http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=270603792546However they never had 60Mhz versions, maybe just question of profit ?They known Measurements Equipment provider, just ask them for 60Mhz.Probably the same (pprofit question) is for "GoodluckSell"http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=280552591608If you compare the price on ebay on taobao.com you will see that a 60Mhz Tekway/Hantek should costs about 400-450$.